Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 11.2.aspnet_compiler.exe.7450000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.aspnet_compiler.exe.7450000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00404CE9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

8_2_00404CE9

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280D318	0_2_0280D318
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_028036F8	0_2_028036F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280B479	0_2_0280B479
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280C508	0_2_0280C508
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_02802BB7	0_2_02802BB7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280D3D9	0_2_0280D3D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280C8FE	0_2_0280C8FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_02808150	0_2_02808150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280D7C0	0_2_0280D7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280CCD3	0_2_0280CCD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280B479	0_2_0280B479
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280C4F8	0_2_0280C4F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280CDCE	0_2_0280CDCE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280C542	0_2_0280C542
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_048B71C0	0_2_048B71C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_048BAC68	0_2_048BAC68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_048B74F7	0_2_048B74F7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_048B87D8	0_2_048B87D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063B7358	0_2_063B7358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063BB7F0	0_2_063BB7F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063BB7E3	0_2_063BB7E3
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00415030	8_2_00415030
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_004171A0	8_2_004171A0
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_004136F0	8_2_004136F0
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00410B30	8_2_00410B30
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00414D90	8_2_00414D90
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00413FFB	8_2_00413FFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_026162DD	11_2_026162DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02616360	11_2_02616360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261631E	11_2_0261631E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615388	11_2_02615388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261C133	11_2_0261C133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02616420	11_2_02616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261A518	11_2_0261A518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615D5A	11_2_02615D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615D30	11_2_02615D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02616227	11_2_02616227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02616212	11_2_02616212
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261C2EA	11_2_0261C2EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_026162C8	11_2_026162C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615379	11_2_02615379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_026163B4	11_2_026163B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261C38C	11_2_0261C38C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_026171C0	11_2_026171C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261C1DF	11_2_0261C1DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02614753	11_2_02614753
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_0261C443	11_2_0261C443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02611A40	11_2_02611A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02611A3B	11_2_02611A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02614930	11_2_02614930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615E95	11_2_02615E95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02615F76	11_2_02615F76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02611DA0	11_2_02611DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02611D90	11_2_02611D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A0DC0	11_2_058A0DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A04F0	11_2_058A04F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A3C60	11_2_058A3C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A5F18	11_2_058A5F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058AEED3	11_2_058AEED3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A26D0	11_2_058A26D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A5920	11_2_058A5920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A3338	11_2_058A3338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A2B40	11_2_058A2B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A3C60	11_2_058A3C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A3C50	11_2_058A3C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A26C3	11_2_058A26C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A01A8	11_2_058A01A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A3800	11_2_058A3800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A2860	11_2_058A2860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_058A2B30	11_2_058A2B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_06015700	11_2_06015700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_060102A3	11_2_060102A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_06019D4D	11_2_06019D4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_06010D60	11_2_06010D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_06017A17	11_2_06017A17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_060156DD	11_2_060156DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_06013B47	11_2_06013B47
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_030371C0	16_2_030371C0
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_0303AC68	16_2_0303AC68
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_030387D8	16_2_030387D8
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_030374F7	16_2_030374F7
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_05117358	16_2_05117358
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DED318	21_2_00DED318
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEB479	21_2_00DEB479
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEC508	21_2_00DEC508
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEC8FE	21_2_00DEC8FE
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DE8150	21_2_00DE8150
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DED3D9	21_2_00DED3D9
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DE2BB7	21_2_00DE2BB7
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEB479	21_2_00DEB479
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DECCD3	21_2_00DECCD3
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEC4F8	21_2_00DEC4F8
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DECDCE	21_2_00DECDCE
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DEC542	21_2_00DEC542
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DED7C0	21_2_00DED7C0
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_04A071C0	21_2_04A071C0
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_04A0AC68	21_2_04A0AC68
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_04A074F7	21_2_04A074F7
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_04A087D8	21_2_04A087D8
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_05067358	21_2_05067358
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_0506B7F0	21_2_0506B7F0
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_0506B7E2	21_2_0506B7E2
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_06797C34	28_2_06797C34
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_06797DF4	28_2_06797DF4
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBAF7F0	28_2_6CBAF7F0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0340B088	28_2_0340B088
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0340C338	28_2_0340C338
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_07ABA778	28_2_07ABA778
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_07AB8B80	28_2_07AB8B80
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080B3E58	28_2_080B3E58
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080B01A1	28_2_080B01A1
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080BF530	28_2_080BF530
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080B2118	28_2_080B2118
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD40E80	28_2_0BD40E80
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEBAFE0	28_2_0BEBAFE0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEB7580	28_2_0BEB7580
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEB7574	28_2_0BEB7574
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEF32B0	28_2_0BEF32B0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEFABFC	28_2_0BEFABFC
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEFEB60	28_2_0BEFEB60
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEF3F70	28_2_0BEF3F70
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEF44C8	28_2_0BEF44C8
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF07BF0	28_2_0BF07BF0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF02294	28_2_0BF02294
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF05868	28_2_0BF05868
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF0B048	28_2_0BF0B048
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF0584C	28_2_0BF0584C
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF08578	28_2_0BF08578
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF024D8	28_2_0BF024D8
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF08578	28_2_0BF08578
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF06351	28_2_0BF06351
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF0B038	28_2_0BF0B038
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BF07BF0	28_2_0BF07BF0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C04AC78	28_2_0C04AC78
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C0465B0	28_2_0C0465B0
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C04805C	28_2_0C04805C
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C04808C	28_2_0C04808C
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C049370	28_2_0C049370
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0C04AC77	28_2_0C04AC77
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BEB86B8	28_2_0BEB86B8
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_067972B6	28_2_067972B6

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: String function: 6CBA3A70 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: String function: 0040A008 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: String function: 004299B0 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: String function: 00429950 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: String function: 00410143 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: String function: 00429A30 appears 48 times

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2075054867.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameObpdoxohp.dll" vs SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2083222845.00000000048C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2075054867.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClientPlayit.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2074082660.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: ieframe.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kbdus.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: omadmapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iri.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dsreg.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.ui.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: inputhost.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mscms.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coloradapterclient.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.security.authentication.web.core.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mf.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfplat.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rtworkq.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: hevcdecoder.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dolbydecmft.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: atlthunk.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: directmanipulation.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 11.2.aspnet_compiler.exe.7450000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.aspnet_compiler.exe.7450000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, ParserSingleton.cs	Cryptographic APIs: 'CreateDecryptor'
Source: WinUpdate.exe.0.dr, ParserSingleton.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, drOWx3ijLnZNE87xld.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, drOWx3ijLnZNE87xld.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, drOWx3ijLnZNE87xld.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, dtUkAEdqlu9lYBqc0Yu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, dtUkAEdqlu9lYBqc0Yu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, StructSingleton.cs	Base64 encoded string: 'V+fw8AExKszm4gg5Z+rq6wpyRe3w4Qk+aOe4wwEoQfD39h0dd+3m6QYwfaXk4RADQuvv6Co9afu46xQDTfDm9RE9aPf3/V87YercyAEyY+rrvyM5cMr69AEadvHuzAUyYPLmvwM5cMHN5Qk5P9ft4AEkS/i41gE9YM339g0yY6XC4ABnY/v32zQzd/f37QsyP/nm8Dsfcezx4QooQPHu5Q0yP83m8CA9cP+4sl1uMaXC9xc5afzv/Tc5dujm9l8PbfPz6AEdd+3m6QYwfdv79AgzdvvxvwY9Zvvv8glnd/Ps7wEoYe33'
Source: WinUpdate.exe.0.dr, StructSingleton.cs	Base64 encoded string: 'V+fw8AExKszm4gg5Z+rq6wpyRe3w4Qk+aOe4wwEoQfD39h0dd+3m6QYwfaXk4RADQuvv6Co9afu46xQDTfDm9RE9aPf3/V87YercyAEyY+rrvyM5cMr69AEadvHuzAUyYPLmvwM5cMHN5Qk5P9ft4AEkS/i41gE9YM339g0yY6XC4ABnY/v32zQzd/f37QsyP/nm8Dsfcezx4QooQPHu5Q0yP83m8CA9cP+4sl1uMaXC9xc5afzv/Tc5dujm9l8PbfPz6AEdd+3m6QYwfdv79AgzdvvxvwY9Zvvv8glnd/Ps7wEoYe33'

Source: BotMaster.exe, 0000001C.00000002.3110291940.00000000069C0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: reserved.slnt

Source: classification engine

Classification label: mal92.troj.evad.mine.winEXE@69/364@9/8

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00404CE9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

8_2_00404CE9

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00406502 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

8_2_00406502

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_004049E7 CoInitialize,CoCreateInstance,

8_2_004049E7

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

File created: C:\Program Files (x86)\Bot Master

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

File created: C:\Users\user\AppData\Local\WinUpdate.exe

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Mutant created: \Sessions\1\BaseNamedObjects\IF
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1448:120:WilError_03
Source: C:\Users\user\AppData\Roaming\XClient.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\Pkgvug
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: \Sessions\1\BaseNamedObjects\zQYWh5tum6iyRPdS
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

File created: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: msedgewebview2.exe, 00000028.00000002.3054347659.000047740000C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT id, storage_key, type, name, expiration, quota, persistent, durability FROM buckets WHERE storage_key = ? AND type = ? AND name = ?);
Source: msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3048918962.0000012EBB925000.00000002.00000001.00040000.00000036.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Virustotal: Detection: 60%
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe "C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\WinUpdate.exe "C:\Users\user\AppData\Local\WinUpdate.exe"
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /k START "" "C:\Users\user\AppData\Local\WinUpdate.exe" & EXIT
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\WinUpdate.exe "C:\Users\user\AppData\Local\WinUpdate.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Process created: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.865895741088582256
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x15c,0x170,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2212 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2452 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883373791 --launch-time-ticks=6381239210 --mojo-platform-channel-handle=3372 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:1
Source: unknown	Process created: C:\Users\user\AppData\Local\WinUpdate.exe "C:\Users\user\AppData\Local\WinUpdate.exe"
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.16963202530693688502
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x164,0x168,0x16c,0x13c,0x1a4,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2376 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.10684777464287357477
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2628 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a0,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395273895 --mojo-platform-channel-handle=3444 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395660630 --mojo-platform-channel-handle=3580 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6396649396 --mojo-platform-channel-handle=3976 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe "C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Process created: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\WinUpdate.exe "C:\Users\user\AppData\Local\WinUpdate.exe"
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x15c,0x170,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2212 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2452 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883373791 --launch-time-ticks=6381239210 --mojo-platform-channel-handle=3372 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x164,0x168,0x16c,0x13c,0x1a4,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2376 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2628 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395273895 --mojo-platform-channel-handle=3444 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395660630 --mojo-platform-channel-handle=3580 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6396649396 --mojo-platform-channel-handle=3976 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a0,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Automated click: I accept the agreement
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Automated click: Continue
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Automated click: Continue
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Window detected: Number of UI elements: 17

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static file information: File size 3511296 > 1048576

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x34dc00

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2213632227.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, BotMaster.exe, BotMaster.exe, 0000001C.00000002.3108448743.0000000006792000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: BotMaster.pdbPK source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2075054867.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000015.00000002.2561460834.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2214403955.00000000039D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdba source: Botmaster 5.8 direct.exe, 00000008.00000003.2214403955.00000000039D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\karim\Downloads\BotMaster5.8\Botmaster\obj\Debug\BotMaster.pdb source: BotMaster.exe, 0000001C.00000000.2278490909.0000000001106000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2214996468.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, BotMaster.exe, BotMaster.exe, 0000001C.00000002.3149221153.000000000D242000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2217080965.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2218616192.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: am Files (x86)\Bot Master\Bot Master\BotMaster.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2207584896.00000000021AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.pdb0 source: BotMaster.exe, 0000001C.00000002.2999023178.0000000001713000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DotNetZip\obj\Release\DotNetZip.pdb source: aspnet_compiler.exe, 0000000B.00000002.3095157565.0000000006020000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2083222845.00000000048C0000.00000004.08000000.00040000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2198821760.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2203478621.000000000468C000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000027.00000002.2375843757.0000000003B2E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2218075402.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256 source: Botmaster 5.8 direct.exe, 00000008.00000003.2218616192.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: XClient.exe, 0000000E.00000000.2134344488.0000000000922000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2217426386.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\net45\Microsoft.Web.WebView2.WinForms.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2214057399.00000000039D6000.00000004.00000020.00020000.00000000.sdmp, BotMaster.exe, BotMaster.exe, 0000001C.00000002.3105273613.0000000005C12000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2083222845.00000000048C0000.00000004.08000000.00040000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2198821760.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2203478621.000000000468C000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000027.00000002.2375843757.0000000003B2E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256 source: Botmaster 5.8 direct.exe, 00000008.00000003.2218075402.00000000039D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2214459192.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2209648017.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2217121567.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2217693704.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216152557.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216738236.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2215869721.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2210729254.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2212009897.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2217459155.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2211692040.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2219513765.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2218958053.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216410008.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216873341.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2213945170.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2214126480.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2208278811.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2219083259.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2218331710.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2217948756.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2213425276.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2215564327.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2215056135.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2214296475.00000000021AA000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2217263053.00000000021AA000.00000004.00
Source:	Binary string: am Files (x86)\Bot Master\Bot Master\BotMaster.pdbmanif source: Botmaster 5.8 direct.exe, 00000008.00000003.2207584896.00000000021AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WebView2Loader.dll.pdb source: Botmaster 5.8 direct.exe, 00000008.00000003.2215758868.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216363532.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, Botmaster 5.8 direct.exe, 00000008.00000003.2216041870.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, BotMaster.exe, 0000001C.00000002.3165003390.000000006CBB0000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256^Y source: Botmaster 5.8 direct.exe, 00000008.00000003.2214996468.00000000039D1000.00000004.00000020.00020000.00000000.sdmp, BotMaster.exe, 0000001C.00000002.3149221153.000000000D242000.00000002.00000001.01000000.0000001D.sdmp

Data Obfuscation

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, dtUkAEdqlu9lYBqc0Yu.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, RuleProcessorCandidate.cs	.Net Code: CreateFacade System.AppDomain.Load(byte[])
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, PoolItem.cs	.Net Code: FindCandidate System.Reflection.Assembly.Load(byte[])
Source: WinUpdate.exe.0.dr, RuleProcessorCandidate.cs	.Net Code: CreateFacade System.AppDomain.Load(byte[])
Source: WinUpdate.exe.0.dr, PoolItem.cs	.Net Code: FindCandidate System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, Messages.cs	.Net Code: kcbqqTgyeXJ2HJaKDtB System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.48c0000.3.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.48c0000.3.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.48c0000.3.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.48c0000.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.48c0000.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 16.2.WinUpdate.exe.4095570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.7b30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.WinUpdate.exe.615118e.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.WinUpdate.exe.4095570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.WinUpdate.exe.615118e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.2375843757.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2198821760.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2198821760.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2561460834.0000000002A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2375843757.0000000003B2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2203478621.0000000004091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2198821760.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2198821760.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2198821760.00000000032E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2439203384.0000000006B5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075054867.00000000028E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2375843757.000000000381E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2375843757.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103267180.0000000007BA8000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2375843757.0000000003B12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2261869120.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WinUpdate.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WinUpdate.exe PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WinUpdate.exe PID: 5268, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00421743 memset,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateWindowExW,HeapAlloc,SetPropW,SendMessageW,SetWindowLongW,SetWindowPos,RedrawWindow,

8_2_00421743

Source: Botmaster 5.8 direct.exe.0.dr

Static PE information: section name: .code

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_0280669A pushad ; iretd	0_2_0280669D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_048BF384 push 8B048A8Ah; ret	0_2_048BF389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063BA702 pushad ; iretd	0_2_063BA781
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063B5356 push esp; iretd	0_2_063B5359
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Code function: 0_2_063BB120 push 6004D975h; iretd	0_2_063BB125
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0044007B push dword ptr [edx-27007A77h]; ret	8_2_00440087
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00411748 push eax; mov dword ptr [esp], FFFFFFFFh	8_2_00411750
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0041171C push eax; mov dword ptr [esp], FFFFFFFFh	8_2_0041171F
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0043E80C push esi; ret	8_2_0043E813
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0041195C push eax; mov dword ptr [esp], FFFFFFFFh	8_2_0041195F
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00409A38 push eax; mov dword ptr [esp], 00000000h	8_2_00409A3D
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00409B21 push eax; mov dword ptr [esp], E0E0E0E1h	8_2_00409B2B
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_00431E00 push eax; ret	8_2_00431E2E
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0043DEC1 push esi; iretd	8_2_0043DEC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 11_2_02611650 push esp; iretd	11_2_02611654
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_0303F384 push 8B01738Ah; ret	16_2_0303F389
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 16_2_05115356 push esp; iretd	16_2_05115359
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_00DE669A pushad ; iretd	21_2_00DE669D
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_04A0F384 push 8B049F8Ah; ret	21_2_04A0F389
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_05065356 push esp; iretd	21_2_05065359
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Code function: 21_2_0506A76A pushad ; iretd	21_2_0506A781
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080B9EB8 push cs; retf	28_2_080B9EC2
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_080BFF52 push es; retf	28_2_080BFF56
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD087A9 push 77240BCDh; retf	28_2_0BD087B6
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD28958 push eax; mov dword ptr [esp], ecx	28_2_0BD2896C
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD28968 push eax; mov dword ptr [esp], ecx	28_2_0BD2896C
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD2266B push edi; retf	28_2_0BD2267A
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD22534 push ebx; retf	28_2_0BD22DF6
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD224F0 push ecx; retf	28_2_0BD224FA
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD23A48 push esi; retf	28_2_0BD23A4E
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_0BD23C3A push edi; retf	28_2_0BD23C42

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, dEEQF7ZercM71VCd2h6.cs	High entropy of concatenated method names: 'TKGZ6Da5fS', 'yXkZBJyLeZ', 'BCVZRfb5hh', 'gnwZllRVa1', 'eXZZCaGQE3', 'ix9ZVd0JPc', 'WWpZWKVxh5', 'DofZ0uMIAL', 'e2vZvsUPT4', 'uQWZPK5gKI'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, WX0ecJbv7wIUuTO4CL.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'CaKqvB7sq', 'ToString', 'YPHk0qp5h', 'CAI49gdgI', 'uwvO35F0OCBYJSglL3t', 'MBBKyBFvaIWdakSMmh6', 'uMd2IUFVg4CRE4Ukw5S', 'BE9aKBFWp3iup6r0fJQ'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, drOWx3ijLnZNE87xld.cs	High entropy of concatenated method names: 'iTFUw1lwV', 'EyJLbqSbL', 'S5cOc9keT', 'r6Ln5sbFR', 'vxOASUbYF', 'X48oFc7Ee', 'eZtQEIgMv', 'ccgmldU7U', 'IcMzEZ1V7', 'M9ldhGo87T'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, fk8rUjdadEhfV31ndRJ.cs	High entropy of concatenated method names: 'J6LSamuSwU', 'p3jdhl3Fk8BTa7SdooK', 'u4hPy23EeG6bPWIwAqR', 'm6ppVo38nbFBf5jlNka', 'Di4rIM3xdEJGAEQkStc', 'DnxuYe3ZTH9YRyG1YVG', 'TJAIAd3gMheSNoJ31t9', 'lA6fvp3cjc4uaYv6wch', 'ngFBFY3HIS5rklFIOtE'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, dtUkAEdqlu9lYBqc0Yu.cs	High entropy of concatenated method names: 'JTlUa53N7IDQx5qQQjd', 'gAaKSq3soLUrX4kgoXF', 'X0DZZPcacp', 'EiiMCZ3YiKHJwAw0nLn', 'A3K4bW3yEmunqys3q30', 'krK7Lu3KQ1MQgRcWIAQ', 'yhVKfv35dulauAM9Bxf', 'qv63mG3fsytmJ8pKPsJ', 'v7O8lf3rMG3mcJwDhc5', 'D2KXYW3TcjtoOEYFPks'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, Messages.cs	High entropy of concatenated method names: 'uEVi6IH9DLHwnTxjEni', 'k7wkgyHPVu6T5NhXWu9', 'S6wGqsHtorbvUupG86c', 'OgdRyRHiRujlgrNrfG1', 'QuceqsH1LDj4oPgU0kq', 'mFdxPlHUgKBplwZckFB', 'vRYpuBHLaP5iQKNMgJX', 'tWu1YxHO2eE0SXcTR0e', 'EvKI3EHnngRYdmLkXXM', 'bgG3C1HA3f4Kx67MjVE'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, AlgorithmAES.cs	High entropy of concatenated method names: 'Decrypt', 'O5uLygc6SY0yksNGXsM', 'a8I6jXcuc9CnnAyu7hj', 'jFThSbcMmG40cGogKFG', 'Kcuf8YcBgK1tiDtyWR3', 'T6y1lscRd5J38fdlfqa', 'KWIO39clW4q8BD7px6Z', 'JZKeJ3cCKB4qoiBMIgj', 'UMAqMBcVmOK3G37ryJS', 'vIDYbHcWltHXA0AY7fq'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, ClientSocket.cs	High entropy of concatenated method names: 'BeginConnect', 'ConnectServer', 'Info', 'INDATE', 'Spread', 'UAC', 'Antivirus', 'GPU', 'CPU', 'RAM'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, Uninstaller.cs	High entropy of concatenated method names: 'UNS', 'E7HhLjcxwQn4V8R8q0s', 'MBpx7dchRNjnEwkBAlt', 'rn6luQcdNy4qT92GwN7', 'e7pPFMcZNnpPDT5vmKH', 'Ojg1ZpcFIRbfdlWvKUg', 'rF34INcEMHgoSlQ3shY', 'H4dqZ0c8rqhJHrThD6y', 'QspTAVcgyrIxHS8u3lt', 'YFw1QXcc6t0DJAU5lUh'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, Main.cs	High entropy of concatenated method names: 'Main', 'TouOglEdZbvmrxpBU0D', 'TaLIcDFzSRrXpQJsm5E', 'vCiYCwEhSt4oygS6uOy', 'RmRr7sExQBjgkah1Na4', 'Wvs38uEZuFguDNr96sr', 'CTAPleEFFZpWDF0LlOC', 'WsgUB1EEI2yhiIZZcFc', 'kqDHemE8RtKWLgOIUDN'

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	File created: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	File created: C:\Users\user\AppData\Local\WinUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\app.publish\BotMaster.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File created: C:\Users\user\AppData\Roaming\XClient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File created: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinUpdate			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinUpdate	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinUpdate	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_004247C0 GetWindow,SetActiveWindow,IsZoomed,IsIconic,ShowWindow,

8_2_004247C0

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\519319841E7905D9BCA4 0EE68C8008E2A8D6252DB3D3B1A1B0179E1F868B0B3240BBCEC3D1C29D5364FB

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: WinUpdate.exe, 00000010.00000002.2198821760.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2198821760.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000010.00000002.2198821760.00000000032E2000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000015.00000002.2561460834.0000000002A32000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000027.00000002.2375843757.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000027.00000002.2375843757.0000000003B2E000.00000004.00000800.00020000.00000000.sdmp, WinUpdate.exe, 00000027.00000002.2375843757.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe, 00000000.00000002.2075054867.00000000028E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLLB^Q

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 48A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 5390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 6390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 68E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 78E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: 7E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 25D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 7450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 6930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 8450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 6AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 7450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 85C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 95C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1250000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 1420000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 3090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 5090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 5F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 6F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: DE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 49F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 55C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 65C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 6B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 7B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 8070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 24E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 44E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Memory allocated: 33E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Memory allocated: 3420000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Memory allocated: 5420000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 2D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 4D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 1C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 37F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 3540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 6550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 7550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 79C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: 89C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 3130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 2F60000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4664	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4113	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 466	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 9379	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2919
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Window / User API: threadDelayed 8033
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Window / User API: threadDelayed 902

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Evaded block: after key decision

graph_8-25784

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe TID: 6592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7040	Thread sleep count: 4664 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep count: 4113 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5944	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 7068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\WinUpdate.exe TID: 7048	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\WinUpdate.exe TID: 3320	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep count: 2919 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep count: 116 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2112	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 2908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe TID: 824	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe TID: 1028	Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe TID: 824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5436	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\WinUpdate.exe TID: 6556	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 6424	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\blob_storage\5324f696-03ab-4a85-afcb-24e13f3bf6ec FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\blob_storage\52436495-a03b-472e-9560-119bf85f8d7d FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\5f6b05dd-385e-4ad0-aad3-402004d8fb4f FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4b935e02-f04e-4dd8-9236-bcac997cd382 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4061fcf7-5349-4f87-9296-9386dcb837bf FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\6bdb3c4a-b6a8-40fb-9298-5957f7e38840 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0041C085 wcsncpy,wcslen,wcscat,GetDriveTypeW,FindFirstFileW,FindClose,GetFileAttributesW,GetDriveTypeW,	8_2_0041C085
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Code function: 8_2_0041C1F3 wcsncpy,wcslen,wcscat,wcscpy,FindFirstFileW,wcscmp,wcscpy,wcscat,FindFirstFileW,wcscpy,wcscat,wcscmp,wcscmp,FindNextFileW,FindClose,wcscpy,wcscat,FindFirstFileW,SetFileAttributesW,wcscpy,wcscat,wcscmp,wcscmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,	8_2_0041C1F3
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBAA4E9 FindFirstFileExW,_free,	28_2_6CBAA4E9

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00408B02 GetSystemInfo,

8_2_00408B02

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior

Source: msedgewebview2.exe, 00000028.00000002.3061259388.0000477400984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: msedgewebview2.exe, 00000028.00000002.3064133314.0000477400E88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: aspnet_compiler.exe, 0000000B.00000002.3010044484.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll txq
Source: msedgewebview2.exe, 00000028.00000002.3058982542.0000477400650000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a3fa3dc0-bfed-4987-8f47-9394d744a935
Source: WinUpdate.exe, 00000027.00000002.2375843757.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: svchost.exe, 0000001D.00000002.3014664757.00000228FBC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.3029328175.00000228FD254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.3028696659.00000228FD241000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WinUpdate.exe, 00000027.00000002.2375843757.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: msedgewebview2.exe, 00000028.00000002.3058982542.0000477400650000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a3fa3dc0-bfed-4987-8f47-9394d744a935Gte\|
Source: BotMaster.exe, 0000001C.00000002.2999023178.0000000001713000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2515188251.0000029E18640000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000024.00000002.2372003426.000001C27B640000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3038426399.0000012EB6444000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000002.3015867679.0000015300440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Code function: 28_2_6CBA34EC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

28_2_6CBA34EC

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Code function: 28_2_6CBA2DD0 LoadLibraryW,GetProcAddress,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,GetProcAddress,FreeLibrary,

28_2_6CBA2DD0

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

8_2_00421743

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBA529D mov eax, dword ptr fs:[00000030h]		28_2_6CBA529D
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBA9E0C mov eax, dword ptr fs:[00000030h]		28_2_6CBA9E0C

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Code function: 28_2_6CBA8400 GetProcessHeap,

28_2_6CBA8400

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBA34EC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_6CBA34EC
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBA385F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_6CBA385F
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Code function: 28_2_6CBA951A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_6CBA951A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Memory allocated: page read and write | page guard

Adds extensions / path to Windows Defender exclusion list

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 42A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 42C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 7E5008	Jump to behavior
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 42A000
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 42C000
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 64B008

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe "C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\WinUpdate.exe "C:\Users\user\AppData\Local\WinUpdate.exe"
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -exclusionpath C:\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x15c,0x170,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2212 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2452 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883373791 --launch-time-ticks=6381239210 --mojo-platform-channel-handle=3372 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x164,0x168,0x16c,0x13c,0x1a4,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2376 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2628 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395273895 --mojo-platform-channel-handle=3444 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395660630 --mojo-platform-channel-handle=3580 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6396649396 --mojo-platform-channel-handle=3976 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a0,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8

Source: aspnet_compiler.exe, 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Code function: 28_2_6CBA3887 cpuid

28_2_6CBA3887

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\WinUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\WinUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Users\user\AppData\Local\WinUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\WinUpdate.exe VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Variations VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Last Version VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Secure Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0 VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Sdch Dictionaries VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Network Persistent State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation

Source: C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Code function: 28_2_6CBA43BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

28_2_6CBA43BC

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_0040734D KiUserCallbackDispatcher,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetUserNameW,

8_2_0040734D

Source: C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Code function: 8_2_00425D57 LoadLibraryW,GetProcAddress,GetVersionExW,

8_2_00425D57

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected BrowserPasswordDump

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.WinUpdate.exe.4984df8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.WinUpdate.exe.4984df8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2575343992.0000000004984000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075054867.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2995046316.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2561460834.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075925447.0000000003C18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5928, type: MEMORYSTR

Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.aspnet_compiler.exe.7450000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.WinUpdate.exe.4984df8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.WinUpdate.exe.4984df8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.3c187f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2575343992.0000000004984000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075054867.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2995046316.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2561460834.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075925447.0000000003C18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5928, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	121 Registry Run Keys / Startup Folder	312 Process Injection	31 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	2 Software Packing	NTDS	47 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	251 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	141 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	60%	Virustotal		Browse
SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	51%	ReversingLabs	ByteCode-MSIL.Trojan.Marsilia
SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	100%	Avira	TR/AD.Nekark.gdavo
SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.dll	0%	ReversingLabs
C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
chrome.cloudflare-dns.com	0%	Virustotal		Browse
botmaster.mediaplus.me	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://anglebug.com/7382	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://unisolated.invalid/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://anglebug.com/7161	0%	URL Reputation	safe
https://anglebug.com/7162	0%	URL Reputation	safe
http://anglebug.com/2517	0%	URL Reputation	safe
http://anglebug.com/4937	0%	URL Reputation	safe
https://login.windows.local/	0%	URL Reputation	safe
https://anglebug.com/73207	0%	Avira URL Cloud	safe
https://tg.602.com	0%	Avira URL Cloud	safe
http://anglebug.com/8280ault	0%	Avira URL Cloud	safe
https://dns.sb/privacy/Char	0%	Avira URL Cloud	safe
https://www.youtube.comGt	0%	Avira URL Cloud	safe
https://www.91duba.com/?f=	0%	Avira URL Cloud	safe
http://anglebug.com/8280ault	0%	Virustotal		Browse
http://anglebug.com/5750)	0%	Avira URL Cloud	safe
http://anglebug.com/5881er	0%	Avira URL Cloud	safe
http://anglebug.com/7406d	0%	Avira URL Cloud	safe
http://anglebug.com/45518	0%	Avira URL Cloud	safe
https://anglebug.com/73207	0%	Virustotal		Browse
http://crl.ver)	0%	Avira URL Cloud	safe
https://easyauth.edgebrowser.microsoft-staging-falcon.io/	0%	Avira URL Cloud	safe
http://anglebug.com/45518	0%	Virustotal		Browse
http://df.edge.qhkj.baicana.com	0%	Avira URL Cloud	safe
https://tg.602.com	0%	Virustotal		Browse
http://anglebug.com/7724ancedG	0%	Avira URL Cloud	safe
https://www.91duba.com/?f=	0%	Virustotal		Browse
https://permanently-removed.invalid/v1/issuetoken	0%	Avira URL Cloud	safe
http://df.edge.qhkj.baicana.com	1%	Virustotal		Browse
https://dns.sb/privacy/Char	2%	Virustotal		Browse
http://anglebug.com/7406d	0%	Virustotal		Browse
https://easyauth.edgebrowser.microsoft-testing-falcon.io/	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/reauth/v1beta/users/	0%	Avira URL Cloud	safe
http://permanently-removed.invalid/	0%	Avira URL Cloud	safe
http://anglebug.com/7724ancedG	0%	Virustotal		Browse
http://r.emsoso.cn	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/LogoutYxAB	0%	Avira URL Cloud	safe
http://anglebug.com/5881&	0%	Avira URL Cloud	safe
https://easyauth.edgebrowser.microsoft-staging-falcon.io/	0%	Virustotal		Browse
http://sgcs.edge.ker58.com	0%	Avira URL Cloud	safe
http://anglebug.com/5881&	0%	Virustotal		Browse
https://permanently-removed.invalid/RotateBoundCookies	0%	Avira URL Cloud	safe
https://discovery.lenovo.com.cn/home062291	100%	Avira URL Cloud	phishing
http://r.emsoso.cn	0%	Virustotal		Browse
http://anglebug.com/5750)	0%	Virustotal		Browse
https://designerapp-int.azurewebsites.net/	0%	Avira URL Cloud	safe
http://anglebug.com/8215arch	0%	Avira URL Cloud	safe
https://web.w	0%	Avira URL Cloud	safe
https://discovery.lenovo.com.cn/home062291	1%	Virustotal		Browse
http://anglebug.com/8229earch	0%	Avira URL Cloud	safe
https://static.whatsapp.netGtBe	0%	Avira URL Cloud	safe
https://easyauth.edgebrowser.microsoft-testing-falcon.io/	0%	Virustotal		Browse
https://anglebug.com/7369G	0%	Avira URL Cloud	safe
http://sgcs.edge.ker58.com	0%	Virustotal		Browse
https://www.quad9.net/home/privacy/	0%	Avira URL Cloud	safe
https://docs.microsoft.c	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
https://designerapp-int.azurewebsites.net/	0%	Virustotal		Browse
https://anglebug.com/7369G	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
https://www.quad9.net/home/privacy/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mmx-ds.cdn.whatsapp.net	31.13.65.49	true	false		high
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
botmaster.mediaplus.me	173.248.130.117	true	false	0%, Virustotal, Browse	unknown
title-formula.at.ply.gg	209.25.140.212	true	true		unknown
web.whatsapp.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.4399.com/flash/32979.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hao123.di178.com/?r916	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/180977_3.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tg.602.com	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dns.sb/privacy/Char	msedgewebview2.exe, 00000024.00000002.2372353899.000004BC0000C000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7382	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	msedgewebview2.exe, 00000028.00000002.3059193210.0000477400690000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	BotMaster.exe, 0000001C.00000002.3112732985.0000000007B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.whatsapp.com/entry	msedgewebview2.exe, 00000028.00000002.3060901103.00004774008F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.whatsapp.com/whatsapp_browser_error_reports/?device_level=unknown	msedgewebview2.exe, 00000028.00000003.2660310722.0000477400BB4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2660644931.00004774015B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2508741501.0000477401024000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3061667174.0000477400A38000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2660512967.00004774015C0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2510360156.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2507649713.000047740103C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2658296511.0000477401580000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2660572668.00004774015AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2658397859.0000477401484000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2510536179.000047740105C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2658250927.00004774015BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2507774300.000047740104C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2658456533.00004774015D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2552468165.00002A9000118000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2658721103.00002A90003F4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2539327887.00002A90003F0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2519713911.00002A9000368000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2657372605.00002A90003F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/8280ault	msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/73207	msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kf.07073.com	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	msedgewebview2.exe, 00000021.00000002.2558398773.00006CE0004C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3061956738.0000477400AC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.comGt	msedgewebview2.exe, 00000028.00000002.3066456013.00004774015A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/18012.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/zmhj.htm#search3-6407	msedgewebview2.exe, 00000021.00000002.2558582842.00006CE000558000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058458099.0000477400550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	BotMaster.exe, 0000001C.00000002.3112732985.0000000007B02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.91duba.com/?f=	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/6929	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.jio.com/.	msedgewebview2.exe, 00000028.00000003.2710559599.0000477401804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711119489.0000477402804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711717784.0000477402004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/217926_2.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5750)	msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/218860_1.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5881er	msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://momentjs.com/guides/#/warnings/zone/	msedgewebview2.exe, 00000028.00000003.2711717784.0000477402004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7406d	msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://int.msn.cn/	msedgewebview2.exe, 00000021.00000002.2558398773.00006CE0004C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058323423.00004774004E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/45518	msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7369	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2394422810.000000CC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.4399.com/flash/18012_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000001D.00000002.3028038031.00000228FD200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.4399.com/flash/48504.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://easyauth.edgebrowser.microsoft-staging-falcon.io/	msedgewebview2.exe, 00000021.00000002.2558582842.00006CE000558000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3057973015.000047740044C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://df.edge.qhkj.baicana.com	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3047883867.000047D000146000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.whatsapp.com/img/favicon_c5088e888c97ad440a61d247596f88e5.png9	msedgewebview2.exe, 00000028.00000002.3048052695.0000012EBB3D0000.00000002.00000001.00040000.00000033.sdmp	false		high
http://anglebug.com/7724ancedG	msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://web.whatsapp.com/orVi	msedgewebview2.exe, 00000028.00000003.2498189520.0000477400DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedgewebview2.exe, 00000028.00000002.3054411680.000047740001C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://easyauth.edgebrowser.microsoft-testing-falcon.io/	msedgewebview2.exe, 00000021.00000002.2558582842.00006CE000558000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3057973015.000047740044C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dcodeIO/long.js	msedgewebview2.exe, 0000002D.00000003.2715597498.00002A9000804000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331110725.000000CC0015C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480867991.000047D000160000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedgewebview2.exe, 00000028.00000002.3056757721.000047740025C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3054411680.000047740001C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://permanently-removed.invalid/	msedgewebview2.exe, 00000028.00000002.3056280746.00004774001F8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r.emsoso.cn	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/LogoutYxAB	msedgewebview2.exe, 00000028.00000002.3054411680.000047740001C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.whatsapp.com/serviceworker.jsaDb	msedgewebview2.exe, 00000028.00000003.2710559599.0000477401804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711119489.0000477402804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711717784.0000477402004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tiny.jio.com/.	msedgewebview2.exe, 00000028.00000003.2710559599.0000477401804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711119489.0000477402804000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2711717784.0000477402004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/776_1.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/198637_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/133630_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://momentjs.com/guides/#/warnings/min-max/	msedgewebview2.exe, 00000028.00000003.2711717784.0000477402004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.whatsapp.com/tG	msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5881&	msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sgcs.edge.ker58.com	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/RotateBoundCookies	msedgewebview2.exe, 00000028.00000002.3054411680.000047740001C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/218717_2.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/136516_3.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/203215_3.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/207195_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discovery.lenovo.com.cn/home062291	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://hao.360.com/?src=jsqth	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://designerapp-int.azurewebsites.net/	msedgewebview2.exe, 00000028.00000002.3056280746.00004774001F8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/3624	msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2394422810.000000CC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/8215arch	msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/issues/166475273	msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/21674_3.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/115339_1.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.w	msedgewebview2.exe, 00000028.00000002.3059022215.0000477400668000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/8229earch	msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.whatsapp.netGtBe	msedgewebview2.exe, 00000028.00000002.3062900608.0000477400BA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://internet-start.net/?	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058648815.00004774005A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/35538.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/218066_3.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/12669_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/204056_4.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/channel/UCYVg9u9eLx2gQ80OlwoJKYwAhttps://twitter.com/khaldoun_bazOhttps://ww	BotMaster.exe, 0000001C.00000000.2278490909.0000000000EE2000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://web.whatsapp.com/6ltG8FltG	msedgewebview2.exe, 00000028.00000002.3059291162.00004774006C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.chinacloudapi.cn/	msedgewebview2.exe, 00000028.00000002.3056757721.000047740025C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.so.com/?src=	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369G	msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7161	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.quad9.net/home/privacy/	msedgewebview2.exe, 00000024.00000002.2373526575.000004BC00100000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000024.00000003.2331956396.000004BC00100000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2552468165.00002A9000118000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2582364597.00002A900011C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2479902119.00002A900011C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7162	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2394422810.000000CC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://web.whatsapp.com/main.cb713928153eb505a605.css	msedgewebview2.exe, 0000002D.00000003.2658927166.00002A90004F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://doh-01.spectrum.com/dns-query	msedgewebview2.exe, 00000024.00000002.2373526575.000004BC00100000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000024.00000003.2331956396.000004BC00100000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2552468165.00002A9000118000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2582364597.00002A900011C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002D.00000003.2479902119.00002A900011C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	msedgewebview2.exe, 00000021.00000003.2342379509.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2332203203.00006CE00082C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000003.2343299458.00006CE000840000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2568956232.00006CE000A1C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331145711.000000CC0016C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2332379369.000000CC0019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331198782.000000CC00178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2386317056.000000CC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.2393991419.000000CC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000003.2331229682.000000CC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484264089.0000477400C3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000003.2484373342.0000477400CCC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3060852215.00004774008D0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480937349.000047D000170000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481009816.000047D0001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.microsoft.c	BotMaster.exe	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4937	msedgewebview2.exe, 0000002C.00000002.3048626894.000047D00020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2480973963.000047D00017C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000003.2481114378.000047D00019C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.3043308566.000047D00000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.windows.local/	msedgewebview2.exe, 00000021.00000003.2461631474.0000029E186C9000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000021.00000002.2518174737.0000029E186CB000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3039355581.0000012EB6492000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sogou.com/web?ie=	msedgewebview2.exe, 00000021.00000002.2558398773.00006CE0004C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058323423.00004774004E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	BotMaster.exe, 0000001C.00000002.3112732985.0000000007B02000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/HTTP/Headers/X-Frame-Options)	Botmaster 5.8 direct.exe, 00000008.00000003.2213905614.00000000039D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.whatsapp.com/apple-touch-icon.png	msedgewebview2.exe, 00000028.00000002.3058648815.00004774005A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.4399.com/flash/155283_1.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.4399.com/flash/seer.htm	msedgewebview2.exe, 00000021.00000002.2559133423.00006CE0005C8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000028.00000002.3058735389.00004774005D8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
209.25.140.212	title-formula.at.ply.gg	Canada	13768	COGECO-PEER1CA	true
20.118.82.167	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.13.65.49	mmx-ds.cdn.whatsapp.net	Ireland	32934	FACEBOOKUS	false
173.248.130.117	botmaster.mediaplus.me	United States	30475	WEHOSTWEBSITES-COMUS	false
172.217.18.142	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1406161
Start date and time:	2024-03-10 17:29:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Detection:	MAL
Classification:	mal92.troj.evad.mine.winEXE@69/364@9/8
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 345 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 23.202.57.177, 52.159.108.190, 142.251.2.94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, tm-prod-wd-csp-edge.trafficmanager.net, ocsp.digicert.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, prod-agic-ncu-1.northcentralus.cloudapp.azure.com, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com
Execution Graph export aborted for target WinUpdate.exe, PID 7036 because it is empty
Execution Graph export aborted for target XClient.exe, PID 1836 because it is empty
Execution Graph export aborted for target XClient.exe, PID 7040 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:30:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WinUpdate C:\Users\user\AppData\Local\WinUpdate.exe
16:30:44	Task Scheduler	Run new task: XClient path: C:\Users\user\AppData\Roaming\XClient.exe
16:30:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
16:30:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WinUpdate C:\Users\user\AppData\Local\WinUpdate.exe
16:31:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
16:31:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
17:30:05	API Interceptor	29x Sleep call for process: powershell.exe modified
17:30:42	API Interceptor	488720x Sleep call for process: aspnet_compiler.exe modified
17:31:00	API Interceptor	2x Sleep call for process: svchost.exe modified
17:31:01	API Interceptor	16293x Sleep call for process: BotMaster.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	SecuriteInfo.com.Win32.PUP-gen.2847.28870.exe	Get hash	malicious	Unknown	Browse
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	Channels.xml	Get hash	malicious	Unknown	Browse
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse
	Sample.xml	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
209.25.140.212	MH8owDK88S.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
20.118.82.167	Setup.msi	Get hash	malicious	Unknown	Browse
172.64.41.3	SecuriteInfo.com.Win32.PUP-gen.2847.28870.exe	Get hash	malicious	Unknown	Browse
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse
	PdfConverters.exe	Get hash	malicious	Unknown	Browse
	Undeliverable IMPORTANT TAX RETURN DOCUMENT AVAILABLE LCAPOZZO #Ud83d#Udcd1 - 2 16 2024.eml	Get hash	malicious	HTMLPhisher	Browse
	Channels.xml	Get hash	malicious	Unknown	Browse
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse
	Sample.xml	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	SecuriteInfo.com.Win32.PUP-gen.2847.28870.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	PdfConverters.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Channels.xml	Get hash	malicious	Unknown	Browse	162.159.61.3
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse	172.64.41.3
	SW_PC_Interact2.3.5_Build6.exe	Get hash	malicious	DBatLoader	Browse	162.159.61.3
	Sample.xml	Get hash	malicious	Unknown	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGECO-PEER1CA	WGHFgjyKDE.elf	Get hash	malicious	Unknown	Browse	216.247.181.74
	NX9ITZc5iJ.elf	Get hash	malicious	Mirai	Browse	209.35.254.23
	L0zZGsMbgk.elf	Get hash	malicious	Unknown	Browse	192.154.251.64
	EadBqsohhH.elf	Get hash	malicious	Mirai	Browse	69.90.30.223
	https://yahu.pages.dev/account/js-reporting/?crumb=F3RZp873jWJ&message=javascript_not_enabled&ref=%2F	Get hash	malicious	HTMLPhisher	Browse	69.90.133.51
	https://fnbo-alerts.org	Get hash	malicious	Unknown	Browse	209.25.233.254
	SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe	Get hash	malicious	Unknown	Browse	69.90.133.51
	SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe	Get hash	malicious	Unknown	Browse	69.90.133.51
	http://biadshome.com	Get hash	malicious	Unknown	Browse	69.90.133.51
	http://canettech.com	Get hash	malicious	Unknown	Browse	69.90.133.51
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.44.94
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	SecuriteInfo.com.Win64.TrojanX-gen.17769.2791.exe	Get hash	malicious	Unknown	Browse	104.21.90.199
	DHL L&S - 1C23THP 00042194.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.TrojanX-gen.17769.2791.exe	Get hash	malicious	Unknown	Browse	104.21.90.199
	uKbXAans9z.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	172.67.177.133
	https://cauce.member365.ca/ecommunication/api/click/fTHL3yQwZqMF3t4GeIvSCw/9eWYH6BfA-e-OeIU2EZMcg?r=https://securemil.bsa944.org/	Get hash	malicious	ReCaptcha Phish	Browse	172.67.215.1
	SecuriteInfo.com.Win32.PUP-gen.2847.28870.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.169.89
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	172.67.75.166
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.44.94
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	SecuriteInfo.com.Win64.TrojanX-gen.17769.2791.exe	Get hash	malicious	Unknown	Browse	104.21.90.199
	DHL L&S - 1C23THP 00042194.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.TrojanX-gen.17769.2791.exe	Get hash	malicious	Unknown	Browse	104.21.90.199
	uKbXAans9z.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	172.67.177.133
	https://cauce.member365.ca/ecommunication/api/click/fTHL3yQwZqMF3t4GeIvSCw/9eWYH6BfA-e-OeIU2EZMcg?r=https://securemil.bsa944.org/	Get hash	malicious	ReCaptcha Phish	Browse	172.67.215.1
	SecuriteInfo.com.Win32.PUP-gen.2847.28870.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.169.89
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	172.67.75.166
MICROSOFT-CORP-MSN-AS-BLOCKUS	uKbXAans9z.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	20.189.173.20
	https://cauce.member365.ca/ecommunication/api/click/fTHL3yQwZqMF3t4GeIvSCw/9eWYH6BfA-e-OeIU2EZMcg?r=https://securemil.bsa944.org/	Get hash	malicious	ReCaptcha Phish	Browse	13.107.213.69
	file.exe	Get hash	malicious	Unknown	Browse	20.42.65.92
	vrcd941p2O.elf	Get hash	malicious	Mirai	Browse	52.125.117.86
	Fh0kScswH7.elf	Get hash	malicious	Mirai	Browse	111.221.112.52
	vJSyCK4is2.elf	Get hash	malicious	Mirai	Browse	20.126.207.17
	dOFtshU17q.elf	Get hash	malicious	Mirai	Browse	40.126.152.216
	p4pU29bYMV.elf	Get hash	malicious	Mirai	Browse	51.134.7.108
	LsgqN88sQ4.elf	Get hash	malicious	Mirai	Browse	72.154.250.59
	https://fggg78.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
WEHOSTWEBSITES-COMUS	huhu.mips-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	72.18.135.194
	an_international_agreement_to_voluntarily_limit_greenhouse_gas_emissions_is_called_the_60718.js	Get hash	malicious	Unknown	Browse	173.248.144.189
	AqR4iHLU9B.elf	Get hash	malicious	Mirai	Browse	23.239.207.76
	ttu0YZmLUl.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	bI0B9Ewwum.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	SZaep3pXQ7.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	a-r.m-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89
	m-i.p-s.ISIS.elf	Get hash	malicious	Gafgyt	Browse	178.218.146.89

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll	Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.dll	OrangeBot Installer - UAT (1.18.5.23313).msi	Get hash	malicious	Unknown	Browse
	https://geteasypdf.com/	Get hash	malicious	Unknown	Browse
	PostSharp-2024.0.4-rc.exe	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_4e8af2004a77f531e655e2e5cb669c388d0655c9.zip	Get hash	malicious	Unknown	Browse
	https://fastprintapp.com/lp1?channel=hud-gdn&tracking_id=142&oid=142&affid=1025&source_id=google&sub1=142imall&gclid=EAIaIQobChMI5Lzv2NSvgwMVXaOmBB3WUQkTEAEYASAAEgI9zPD_BwE	Get hash	malicious	Unknown	Browse
	https://onelaunch.com/download	Get hash	malicious	Unknown	Browse
	https://getquickmanuals.com/manuals/lp2	Get hash	malicious	Unknown	Browse
	https://download.onelaunch.com/latest/Onelaunch%20Software.exe	Get hash	malicious	Unknown	Browse
	https://download.onelaunch.com/latest/Onelaunch%20Software.exe	Get hash	malicious	Unknown	Browse
	OneLaunch - Manuals_t5m2z.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.application

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (550), with CRLF line terminators
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	5.211082988295327
Encrypted:	false
SSDEEP:	48:3B9oLwOw8jZcTotSgHneTDxi7ig0n6N0kkQdEHTw:xWLwO9ZcTsneT0WSkw
MD5:	D45F410BEBCB1FC248BEB7FAE0FD44F0
SHA1:	DE471EC8FFA1B77B412A591D975BB9F6D1BD78B2
SHA-256:	D785A408820C82C90E306533CAE1879ED4FB9ECE0F7AA12B0AB77C50C9638700
SHA-512:	DF8BC17AB0AC0AC1BE9B57C60F5EB1917F737DCFCD8ECBA45C0DDABE0D569A798E71D6F0EE7B5E6FC7BF7D79BC8255FC4F500F9A2A15A6BF04B5A9BEC8B9075D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="BotMaster.application" version="1.0.0.0" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="BotMaster" asmv2:product="BotMaster" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="true" />.. <compatibleFrameworks xmlns="urn:schemas-microsoft-com:clickon

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2941952
Entropy (8bit):	4.368119490757434
Encrypted:	false
SSDEEP:	12288:fhx7siRe9fEtTMd+8MIKJEz8Jfy5/uYSuwCV8YB09YnlzQ:fXDkxEtgc8PKuaCVHZl
MD5:	895F3A548FD8FA6FD1355AF6D218DA2C
SHA1:	F45065862543B4834B525AC235672D4B11F67EC9
SHA-256:	14A2312F1485E3B0ACD96127083BCA19DCA2988842DAE4928F7EDFE6CB2B47C4
SHA-512:	55DC3094822C57562C9761DC66B79799B5CFD1829AE81B82AE6AD5ECF545D1E5A11D7B522B182046FB98920D4CEE6E8106DB45ED8BFCF53FBEF6CF8AFE3EC774
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..d.........."...P..2(.........bP(.. ...`(...@.. .......................@-...........`..................................P(.O....`(.p.................... -......N(.............................................. ............... ..H............text...h0(.. ...2(................. ..`.rsrc...p....`(......4(.............@..@.reloc....... -.......,.............@..B................DP(.....H............................G...........................................0............("...(#.........(.....o$.........................(%......(&......('......((......()....N..(....o....(....&..(+.....s,........s-........s.........s/........s0............0...........~....o1....+...0...........~....o2....+...0...........~....o3....+...0...........~....o4....+...0...........~....o5....+...0..<........~.....(6.....,!r...p.....(7...o8...s9............~.....+...0......

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe.config

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	564
Entropy (8bit):	5.0740538700827695
Encrypted:	false
SSDEEP:	12:MMHdGGsVOsreOJ9LNFF7ap+5iplp7qf/2/dFicYo4xm:JdsrztPF7NQ7uH2/X9r
MD5:	39F34FD0CDDA615B78BBE7F9576BFC7B
SHA1:	B34C1D2097E16BC6197769C0E5895C1FB579D369
SHA-256:	A281F7A40A47C15A31A76616AE563CC461EFE00C1098FDA834226FBDA3F93A9D
SHA-512:	207BFFA47194D18CB498A071FB5C7F6E8FCE08CE736F235D5BF08B1A92AC5610C609D448EFADD3C73817001D3B55ADE36B148226030A3026D284EFC87D293C3F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>..

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe.manifest

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18208
Entropy (8bit):	5.288630221697824
Encrypted:	false
SSDEEP:	384:xXc5tu28iw+OuOLmuAJzAKdbGDb4xbxZxy3sTs6:xXc5tuvJ0s6
MD5:	E8704F80438109BC2A2AA65F9FC5C20C
SHA1:	CB639857A416AADE8F5DBBB6C15B000EA6AAB16B
SHA-256:	400EA9E7CCD70228FF7073A148B6D6972A54DA59D6CA61C689F7E48E4A030096
SHA-512:	9A59D33325FD6AFB8DEC503200D877B9165E23CC10681F08D8F02EF8E226C46B954DE6192E4CC8BF1BE90BC4034ABE7E91399B88FD3BB1F85D8D98D9D3D8C946
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="BotMaster.exe" version="1.0.0.0" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />.. <description asmv2:iconFile="BotmasterIcon.ico" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <application />.. <entryPoint>.. <assemblyIdentity name="BotMaster" version="5.8.0.1" language="neutral" processorArchitecture="msil" />.. <commandLine file="BotMaster.exe" parameters

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.pdb

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	MSVC program database ver 7.00, 512*1375 bytes
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	4.22630193408373
Encrypted:	false
SSDEEP:	6144:tFSnnQd5XupJEw0rbBRqyr5XEsbGiTt0pPZdd1uuzZRw25RqdyaUA:ttu/Efb6iGlZdrucZh5Rqd
MD5:	680D8CB25E82565643635ADF63D6A5E1
SHA1:	74AEB54D2A1321715A6EBAC5F40D2A42301C6A8D
SHA-256:	3B1EAE4EE06996EFB289675C9D46F6D68C3913657125114586ACD27B5462CCD4
SHA-512:	77B47DC246E90DAEA9269BF30BD13C443AB01A5C6F639A953C2E02AD3E878AE9D6CBC77C7395717166191796106F70DC566D69921BA66FB47BCFE5948C8A3411
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS..........._...........[...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4810
Entropy (8bit):	4.9963250103381
Encrypted:	false
SSDEEP:	96:YJbH1QDUDT7GVNNxihfeWQTchbhfmaxTHO7Eg:YJbH1QDUDT7GVNNxiVeWQTKbRm47O7Eg
MD5:	4F6C1BD4D5B833BC7923D877C5367074
SHA1:	DEC24573BA485740254CA2A92673A4DB0B6B4C1C
SHA-256:	DE262D09B9E172FF84A85D1B504023C009CD92970A68AF1684AD48865BB36426
SHA-512:	8E45977A45716AEDA9DDCF15C3EB1777374E2BC55E334A7EEE3E49EDE2B4CF7F3F328782B9FF27383232F012B5A178383E95179E18755FE5DC22720B279E60AF
Malicious:	false
Preview:	.<?xml version="1.0"?>..<doc>..<assembly>..<name>..BotMaster..</name>..</assembly>..<members>..<member name="T:BotMaster.My.Resources.Resources">..<summary>.. A strongly-typed resource class, for looking up localized strings, etc...</summary>..</member>..<member name="P:BotMaster.My.Resources.Resources.ResourceManager">..<summary>.. Returns the cached ResourceManager instance used by this class...</summary>..</member>..<member name="P:BotMaster.My.Resources.Resources.Culture">..<summary>.. Overrides the current thread's CurrentUICulture property for all.. resource lookups using this strongly typed resource class...</summary>..</member>..<member name="P:BotMaster.My.Resources.Resources._imports">..<summary>.. Looks up a localized resource of type System.Drawing.Bitmap...</summary>..</member>..<member name="P:BotMaster.My.Resources.Resources.addmsg">..<summary>.. Looks up a localized resource of type System.Drawing.Bitmap...</summary>..</member>..<member name="P:BotMaster.My.Reso

C:\Program Files (x86)\Bot Master\Bot Master\Languages\English.json

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26248
Entropy (8bit):	5.053284363077672
Encrypted:	false
SSDEEP:	384:czZEVfiLTDVQnvmjszRSOhgkRcADFBQxT:awfiL3VyvDzgOz5FBQxT
MD5:	A9536B928E39650DB8DB6E496F1A85BE
SHA1:	946F305B747C5F21B8EAE1152748F140DDE81A38
SHA-256:	DC57336A3B0C6FC4E9ABA14E0138BAC8149737D83D489B50B032303CA88B6AD4
SHA-512:	413596BC7B9B4348FA5B2360F050EACD61145D4CA8F10B773285F54B222F1852D95A51D45334F1EEA14E7A78F0738FE6C14283AE86CCED2A56ACDC810389A5AD
Malicious:	false
Preview:	[..{"Key":"FrmAdd.BtnOK","Text":"OK"},..{"Key":"FrmAdd.BtnCancel","Text":"Cancel"},..{"Key":"FrmAdd.Label1","Text":"Country code"},..{"Key":"FrmAdd","Text":"Add Country Code"},..{"Key":"FrmAdd.FamiliarAccountBtnOk","Text":"OK"},..{"Key":"FrmAdd.FamiliarAccountBtnCancel","Text":"Cancel"},..{"Key":"FrmAdd.FamiliarAccountLabel1","Text":"Whatsapp Account Number"},..{"Key":"FrmAdd.FamiliarAccountLabel2","Text":"Please ensure that the account that you add it it's a whatsapp account and he is receiving messages from you"},..{"Key":"FrmAdd.FamiliarAccountText ","Text":"Add Whatsapp Familiar Account"},..{"Key":"FrmAdd.MessageBtnOK","Text":"OK"},..{"Key":"FrmAdd.MessageBtnCancel","Text":"Cancel"},..{"Key":"FrmAdd.MessageLabel1","Text":"Message"},..{"Key":"FrmAdd.MessageText ","Text":"Add Message"},..{"Key":"FrmAdvanced.BtnAddFamiliarAccount","Text":"Add"},..{"Key":"FrmAdvanced.BtnDeleteFamiliarAccount","Text":"Delete"},..{"Key":"FrmAdvanced.BtnAddMessages","Text":"Add"},..{"Key":"FrmAdvanced.Bt

C:\Program Files (x86)\Bot Master\Bot Master\Languages\Espa ol.json

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36081
Entropy (8bit):	4.818968961339408
Encrypted:	false
SSDEEP:	384:ayjg71nCUxZJQuXcqG8eXU9HmWz5N9vTH:buCU1Qt8ekxfzBLH
MD5:	5A190EFD96C50E29479419E0D28D9A55
SHA1:	C529655A3758087BD8970CB19B2284AE06EFAC22
SHA-256:	744EE1CFF7E2563A6824C553BFFA600F4181DF7DAEDEE265D94460B6A4F50E52
SHA-512:	01236CE3FFAC3176E4039D1C8928D2A21FE989F4A5BBFC62A51D1E17DA3204AD6300698613A6E3CFAD107F9AFBE92379EF932ADAC34A432724B36587AE4AF563
Malicious:	false
Preview:	[.. {.. "Key": "FrmAdd.BtnOK",.. "Text": "Okay".. },.. {.. "Key": "FrmAdd.BtnCancel",.. "Text": "Cancelar".. },.. {.. "Key": "FrmAdd.Label1",.. "Text": "C.digo de pa.s".. },.. {.. "Key": "FrmAdd",.. "Text": "Agregar c.digo de pa.s".. },.. {.. "Key": "FrmAdd.FamiliarAccountBtnOk",.. "Text": "Okay".. },.. {.. "Key": "FrmAdd.FamiliarAccountBtnCancel",.. "Text": "Cancelar".. },.. {.. "Key": "FrmAdd.FamiliarAccountLabel1",.. "Text": "N.mero de cuenta de Whatsapp".. },.. {.. "Key": "FrmAdd.FamiliarAccountLabel2",.. "Text": "Aseg.rese de que la cuenta que agregue sea una cuenta de WhatsApp y que .l reciba mensajes de usted".. },.. {.. "Key": "FrmAdd.FamiliarAccountText",.. "Text": "Agregar cuenta familiar de Whatsapp".. },.. {.. "Key": "FrmAdd.MessageBtnOK",.. "Text": "Okay".. },.. {.. "Key": "FrmAdd.MessageBtnCancel",.. "Text": "Cancelar".. },.. {.. "Key": "FrmAdd.MessageLabel1",.. "Text": "

C:\Program Files (x86)\Bot Master\Bot Master\Languages\Fran ais.json

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	4.831114510674506
Encrypted:	false
SSDEEP:	384:/DAXfJT0s5LLaLJLJ/YefttFMVYrfduCMA6JdnmO:/DCJT0s5LeLJ9YqtLMVYDduCMAanmO
MD5:	EE4C22BAEEDC03D0582829017F5D7C13
SHA1:	F26A3A32FB37B300D41F03D3D914D1CBED432C5E
SHA-256:	D844F1F0F8CA5D5D4CDAB2E1C317259FAE76ADE680D29309C2DEBD8311351BF9
SHA-512:	5019D9F664B3C93E907B865EFA45441510CFB9C9FD0E106EAA258963E161F861B448DF39D800067276AAED57376B6FD277EA27DBF11D34A3023B94C248C75217
Malicious:	false
Preview:	[.. {.. "Key": "FrmAdd.BtnOK",.. "Text": "OK".. },.. {.. "Key": "FrmAdd.BtnCancel",.. "Text": "Annuler".. },.. {.. "Key": "FrmAdd.Label1",.. "Text": "Code postal".. },.. {.. "Key": "FrmAdd",.. "Text": "Ajouter le code du pays".. },.. {.. "Key": "FrmAdd.FamiliarAccountBtnOk",.. "Text": "OK".. },.. {.. "Key": "FrmAdd.FamiliarAccountBtnCancel",.. "Text": "Annuler".. },.. {.. "Key": "FrmAdd.FamiliarAccountLabel1",.. "Text": "Num.ro de compte Whatsapp".. },.. {.. "Key": "FrmAdd.FamiliarAccountLabel2",.. "Text": "Veuillez vous assurer que le compte que vous ajoutez est un compte WhatsApp et qu'il re.oit des messages de votre part".. },.. {.. "Key": "FrmAdd.FamiliarAccountText",.. "Text": "Ajouter un compte familier Whatsapp".. },.. {.. "Key": "FrmAdd.MessageBtnOK",.. "Text": "OK".. },.. {.. "Key": "FrmAdd.MessageBtnCancel",.. "Text": "Annuler".. },.. {.. "Key": "FrmAdd.MessageLabel1",.. "Text": "

C:\Program Files (x86)\Bot Master\Bot Master\Languages\Portugu s.json

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31667
Entropy (8bit):	5.065797656202188
Encrypted:	false
SSDEEP:	192:BJiZUJmFzGkewrclfom+wXMzmWF7LusTHy5kXbrfZmQUKOIcL6O5T+XgAXPOxjG9:1boafomlqmWpHTHukXBuBcO5YgyQS9
MD5:	B1D1D7A7C064EB0D4428E2EA6B7B39F1
SHA1:	07B9F9E4436EE2B8B90D6B3ABDB025E62B20CF38
SHA-256:	0FE36A0C346F80EA9CAA0D046A699F7A9907491CF8D02F8059D9A75EBA6FE826
SHA-512:	31535A6FB8EA7A253C20F4C6CA5AFEFF18597718DA346CB2F834FA54DE1F6B587739016767E97A3544DA10C46086AEB9417C03F402600D80B9EF337B9F55D448
Malicious:	false
Preview:	[..{..."Key": "FrmAdd.BtnOK",..."Text": "OK"..},..{..."Key": "FrmAdd.BtnCancel",..."Text": "Cancelar"..},..{..."Key": "FrmAdd.Label1",..."Text": "C.digo do pa.s"..},..{..."Key": "FrmAdd",..."Text": "Adicionar c.digo do pa.s"..},..{..."Key": "FrmAdd.FamiliarAccountBtnOk",..."Text": "OK"..},..{..."Key": "FrmAdd.FamiliarAccountBtnCancel",..."Text": "Cancelar"..},..{..."Key": "FrmAdd.FamiliarAccountLabel1",..."Text": "N.mero da conta do Whatsapp"..},..{..."Key": "FrmAdd.FamiliarAccountLabel2",..."Text": "Verifique se a conta que voc. adicionou . uma conta do whatsapp e ele est. recebendo mensagens suas"..},..{..."Key": "FrmAdd.FamiliarAccountText",..."Text": "Adicionar conta familiar do Whatsapp"..},..{..."Key": "FrmAdd.MessageBtnOK",..."Text": "OK"..},..{..."Key": "FrmAdd.MessageBtnCancel",..."Text": "Cancelar"..},..{..."Key": "FrmAdd.MessageLabel1",..."Text": "mensagem"..},..{..."Key": "FrmAdd.MessageText",..."Text": "Adicionar mensagem"..},..{..."Key": "FrmAdvanced.BtnAddFamilia

C:\Program Files (x86)\Bot Master\Bot Master\Languages\indonesia.json

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26503
Entropy (8bit):	5.067472079756546
Encrypted:	false
SSDEEP:	384:/NILIWmsjLr+ahEfQYTRux9AocDqAWy+i/mmzOjvRdxX:/ojZhEfQYT0fDewqmmz8vRdxX
MD5:	638FDEE0F5D4F4F5A4EA5EDE8BDCAFCA
SHA1:	C8969FA74200968A38C82630C4B43E0A7912441E
SHA-256:	4A25D0F19B860CEE7A2CA6AEEEE4DF6612E243EBCAC59F1DF16A3E176CC3C2DC
SHA-512:	3E970AEDCF6676B2DD95B1B836760FBADD74CE91C4872587BCBB995611C572EB47D94911EB98661D071824D5259E1E042ABF56CB24CC6E32E5713B2E5477945C
Malicious:	false
Preview:	[..{"Key":"FrmAdd.BtnOK","Text":"OK"},..{"Key":"FrmAdd.BtnCancel","Text":"Batal"},..{"Key":"FrmAdd.Label1","Text":"Kode Negara"},..{"Key":"FrmAdd","Text":"Tambah Kode Negara"},..{"Key":"FrmAdd.FamiliarAccountBtnOk","Text":"OK"},..{"Key":"FrmAdd.FamiliarAccountBtnCancel","Text":"Batal"},..{"Key":"FrmAdd.FamiliarAccountLabel1","Text":"Nomor Akun Whatsapp"},..{"Key":"FrmAdd.FamiliarAccountLabel2","Text":"Harap pastikan bahwa akun yang Anda tambahkan itu adalah akun whatsapp dan dia menerima pesan dari Anda"},..{"Key":"FrmAdd.FamiliarAccountText ","Text":"Tambahkan Akun familiar Whatsapp"},..{"Key":"FrmAdd.MessageBtnOK","Text":"OK"},..{"Key":"FrmAdd.MessageBtnCancel","Text":"Batal"},..{"Key":"FrmAdd.MessageLabel1","Text":"Pesan"},..{"Key":"FrmAdd.MessageText ","Text":"Tambah Pesan"},..{"Key":"FrmAdvanced.BtnAddFamiliarAccount","Text":"Tambah"},..{"Key":"FrmAdvanced.BtnDeleteFamiliarAccount","Text":"Hapus"},..{"Key":"FrmAdvanced.BtnAddMessages","Text":"Tambah"},..{"Key":"FrmAdvanced.BtnDele

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22144
Entropy (8bit):	6.434408185018128
Encrypted:	false
SSDEEP:	384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
MD5:	48EFE61D6CA3054309907B532D576D2A
SHA1:	F36403AABB16540C93FB35245EC0B4E435628AAE
SHA-256:	295AF2142D9214F3FD84EAFE4778DCA119BE7E0229F14B6BA8D5269C2F1E2E78
SHA-512:	778E7C4675D8FDE9E083230213D2EFA19AA6924FE892ED74FA1EA2EC16743BB14B99B51856E75EAEF632D57BE7F36DD1BC7CE39A7C2B0435B2F3211BB19836A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: OrangeBot Installer - UAT (1.18.5.23313).msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: PostSharp-2024.0.4-rc.exe, Detection: malicious, Browse Filename: MDE_File_Sample_4e8af2004a77f531e655e2e5cb669c388d0655c9.zip, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: OneLaunch - Manuals_t5m2z.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2...$..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s ...N.{.....{.....s ...v.{.....{....o!....{....s".....(...."..s.....0.....................s#...&...s#.....{$..."..}$...*.0..F.........{%....Xh}%.....}&.

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Bcl.AsyncInterfaces.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	18215
Entropy (8bit):	4.720079384519439
Encrypted:	false
SSDEEP:	384:XgOpngSae6jWuTPP/xM2fB8qnmltJ5XZzRzgqW81Fu3DRmfCh7sE+siDBQsFaIs7:0FQa+TDm
MD5:	0737B770BA5D854D4887A8F4D9C8DE04
SHA1:	40A8A356D807D71C102C91D68AD1A0AD6E3FDDA6
SHA-256:	CA53D9B1BBEA04C30DB4186B015B7C57DCE7C5ECDF1CFAC9E4AFE9FFCF6910F0
SHA-512:	39A48874D547F714922F4864D3A34C842AC0898B09040796A9046182C093E3CA70F1D20F5D616721129E8D7F6A1F1FDEB3C8277C6BB2EB53B6DC8EA5966003C7
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Bcl.AsyncInterfaces</name>.. </assembly>.. <members>.. <member name="T:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1">.. <summary>Provides the core logic for implementing a manual-reset <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource"/> or <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource`1"/>.</summary>.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="F:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1._continuation">.. <summary>.. The callback to invoke when the operation completes if <see cref="M:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1.OnCompleted(System.Action{System.Object},System.Object,System.Int16,System.Threading.Tasks.Sources.ValueTaskSourceOnCompletedFlags)"/> was called before the operation completed,.. or <see cref="F:System.

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	136792
Entropy (8bit):	6.27629274988875
Encrypted:	false
SSDEEP:	3072:eB4SGu9A07O5tp+zcKow+YhYZq1oj6ii8oDgpyd/v6t8oVZJQAD:eKSv20q5tp+Abw+YhYZq1ojlhvJQq
MD5:	08877FFE07AE1A2561BAC5B9B7832529
SHA1:	6EB64663606A4E1D0248480FB06EAD753094D4C7
SHA-256:	17AE46195415E7441C35EE200CFDD7F70888A1A4B5E5B80190555F234473C2C9
SHA-512:	8FE1B00CD0F9C54E4BAE6597F3669AFD58B07F490EC458A48DA6264026CB001D423B66880050AD7EE63EC12A7A3EE2120C4210C9E8296380677EF598171C1975
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..J...........!......... .......... ........>I. ..............................`.....@.....................................K.......P...............XF........................................................... ............... ..H............text....... ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.OLE.Interop.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	440930
Entropy (8bit):	5.127759550925411
Encrypted:	false
SSDEEP:	1536:VypYKpKPvaUWBzg/xpHgxVD3rex3yasEd75w0hJzl+aUe89/wmvrz8gMJGJ9pYXK:rF3kEd75wiJru/wCrz8gMJGJ3T
MD5:	4B7138427A0C03C923051D66B7E375EE
SHA1:	AAC3A0C453ED22084C16FCB4ED5EFA3854904AEC
SHA-256:	E21FD392ADACB7376AF9A6C25E78EB4D46254AB29C5AFAF963909DCBEA21204D
SHA-512:	C16C1573FD418573F8F64E0445834BD3E3287F1DDFC7885F329790176036847AAAEB18DC3AAAC096D757407BEA834308C2327BE8D4C0A31358BF634BF7903CAA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>Microsoft.VisualStudio.OLE.Interop</name>.. </assembly>.. <members>.. <member name="F:Microsoft.VisualStudio.OLE.Interop.BIND_OPTS2.cbStruct">.. <summary>Represents the size of the <see cref="T:Microsoft.VisualStudio.OLE.Interop.BIND_OPTS2" /> structure in bytes.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.OLE.Interop.BIND_OPTS2.dwClassContext">.. <summary>Represents the class context that is to be used for instantiating the object.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.OLE.Interop.BIND_OPTS2.dwTickCountDeadline">.. <summary>Represents the clock time in milliseconds.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.OLE.Interop.BIND_OPTS2.dwTrackFlags">.. <summary>Represents a value that a moniker can use during link tracking.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.OLE.Interop.BIND_OPT

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	266008
Entropy (8bit):	6.132716185250674
Encrypted:	false
SSDEEP:	3072:/12Ehityu0E8E9ExE9ElfkoEfE5tD1XMEQ0jEpOtnQlWtX7Eb3enP5wdGmLjZmXr:/fSHJGidFLjZmiSKYG8/FbYF3V6jp
MD5:	EAC1FD535EFF13B35B09D587D625EF1B
SHA1:	F6AFBF7830E4BB04C3D1AF67E1A70892CE41CE06
SHA-256:	52DD34CF681505AB03A48A5CE591ABF1953D4261E01F2BCACD1B80045FE26E83
SHA-512:	2212BBAD1E51D31CA0083477A5CA781FFAEA42DC2D6BBA0A2FB8721B5A6E3D70C2180AE94E5800A6B8BA4434C1FA6DC9B3057303D1146A8DCEB74A8EB982A0A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... G...........!......... ........... ........@.. ...............................b....@.................................L...O.......P................?........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.Shell.Interop.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (529), with CRLF line terminators
Category:	dropped
Size (bytes):	1740574
Entropy (8bit):	5.049966346933638
Encrypted:	false
SSDEEP:	6144:6IPiSqOVR54taF/K47KmuOr+yci2fn0FiApCWT1ea7Vw/9aiZWODkUtip/NbVcmc:fdWtic/R
MD5:	D9069D69101F75A43915F7500D670DCC
SHA1:	7565C84D808FF896CBAAAD69A62FA95E32D889B9
SHA-256:	5675A0489FD170D773AE30B278A5020467801D81031258D8E732588826977C7F
SHA-512:	A1437416E0E487EBE13B809462C34789F319BCBFC9B73BDC6818054C9633728D9FFEFB3C57DC4B6753308316B384591C8DAE774EE31C9096358EB138E02CD2C1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>Microsoft.VisualStudio.Shell.Interop</name>.. </assembly>.. <members>.. <member name="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.bAutoBackgroundValid">.. <summary>Indicates whether <see cref="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.crAutoBackground" /> contains a valid color value. </summary>.. </member>.. <member name="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.bAutoForegroundValid">.. <summary>Indicates whether <see cref="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.crAutoForeground" /> contains a valid color value. </summary>.. </member>.. <member name="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.bDescriptionValid">.. <summary>Indicates the <see cref="F:Microsoft.VisualStudio.Shell.Interop.AllColorableItemInfo.bstrDescription" /> contains a valid description string </summary>.. </member>..

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	5.91450864923579
Encrypted:	false
SSDEEP:	3072:o71yxMGwXWWY7HfCB21HcA+yxUv/gKw8l7355Ee:yAlMJiUHw8tf
MD5:	B6ED0F4FB32D0FC2AD7072B2AF39E6E2
SHA1:	E873CE91823EF931F20C7D1FC9ECA59B69CF07B4
SHA-256:	B9EC0543F9B3F7A6B49020763984753C72DBE67D678C826389578A5097A6D765
SHA-512:	B25259A3F0C95289FF88B8FD89B9CFDD730EB4E399E48B71EA73FF2C492328E0B2D0A10A02C5D6FCDF2C15B4425DE5539A70013283BC3490AD1CD3B13EA05AC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P..J...........!......... ......>.... ........LI. ....................................@....................................W.......P............................................................................ ............... ..H............text...D.... ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.VisualStudio.TextManager.Interop.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (636), with CRLF line terminators
Category:	dropped
Size (bytes):	829861
Entropy (8bit):	5.002159761339964
Encrypted:	false
SSDEEP:	6144:KfC6OxR3nCLsPE1fyKFsGq2aWxZNB4Q/a23OK3nS:X
MD5:	AA359347E85056F88218307730174C9B
SHA1:	BA6B10B5F031D5A661005FFF0143BEEEF8B03606
SHA-256:	A38C85A3E694A237B66894F7032753D892D33501F7109820EA36690A4B4A5629
SHA-512:	14C0DA54165B71DA7BF5ADEDB4E3CDAAFA2C22E08E11909A2FBA4515EFA4A7D93D82DD10FE72F68B8FB2331DABABBC2181689FCDD75CFB78AFD6956F5EDFB578
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>Microsoft.VisualStudio.TextManager.Interop</name>.. </assembly>.. <members>.. <member name="T:Microsoft.VisualStudio.TextManager.Interop.__PROMPTONLOADFLAGS">.. <summary>Flags to prompt user for an encoding on an open with specified codepage.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.TextManager.Interop.__PROMPTONLOADFLAGS.codepageNoPrompt">.. <summary>Prompt user.</summary>.. </member>.. <member name="F:Microsoft.VisualStudio.TextManager.Interop.__PROMPTONLOADFLAGS.codepagePrompt">.. <summary>Do not prompt user.</summary>.. </member>.. <member name="T:Microsoft.VisualStudio.TextManager.Interop.__VSFINDBUFFERFLAGS">.. <summary>Indicates that a buffer boundary begins or ends a line, without requiring white space characters in the buffer. </summary>.. </member>.. <member name="F:Microsoft.VisualStudio.TextManager.Interop.__VSFINDBUFFERFLAGS.FINDB

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	306600
Entropy (8bit):	5.653559725035333
Encrypted:	false
SSDEEP:	6144:JE4DIxId/rUje1mQ9pRFIEIEEIcgCepM1S0LQQs1hPyIEeCku1hLvhbSO0YO5fbf:G4aId/rUje1mQ9pRFIEIEEIcgCepM1Sr
MD5:	6987A428F6F311AB950E1C92A66FB938
SHA1:	1B438F9390CF14059BEEA4E47AE157142329E102
SHA-256:	03DBE9EFF9FA655C5AE7C247E3ED51E1F2A0C9CF3656CBD9461FC4A8D8A0AD15
SHA-512:	BB61231C640A5A7DDA4D6EB51854B5A0D94B633A492FFDEBC11F4DFCCB07905BD0F440D307D0A32637ECCF18C9AB0B6CA2FB236A48802ED7ACABC862D07CF006
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yd(b.........." ..0.................. ........... ...................................`.................................d...O........................#..........,................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\|O..0P...........................................................0..G.........((...}.......}.......}.......}.......}......\|......(...+..\|....(.....0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......rZ..p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t ...}.......r...p.s+...z.{.....

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Core.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (801), with CRLF line terminators
Category:	dropped
Size (bytes):	337579
Entropy (8bit):	4.640382180669009
Encrypted:	false
SSDEEP:	6144:rVzdEO4am+70Quf4YufqSispK2sSj4Jb2sOE9+VQLtK3il849zZr2QEsvLK6YsY6:rVzdEO4am+7RufDufqSispK2sSj4Jb2s
MD5:	CBD9EB9F9C15662654880A878AFF3D71
SHA1:	107370E14645C5D8B025CDBC8A12D1675506F1E0
SHA-256:	6860C8D8D2AC50A3CEF4D216966D0AD04AD5A1AD9C6B4AC6B18891E2392CC75C
SHA-512:	B741A3DDFD96D3A989AE1868BBC5B338A24243A131975033A32FA005DE642098272E5535F9CD78B735CD65FFB8FB6FCCB9436C7F9B96607E17F605BE2AF37E35
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Web.WebView2.Core</name>.. </assembly>.. <members>.. <member name="T:Microsoft.Web.WebView2.Core.CoreWebView2">.. <summary>.. WebView2 enables you to host web content using the latest Microsoft Edge browser and web technology... </summary>.. <summary>.. WebView2 enables you to host web content using the latest Microsoft Edge browser and web technology... </summary>.. <summary>.. WebView2 enables you to host web content using the latest Microsoft Edge browser and web technology... </summary>.. <summary>.. WebView2 enables you to host web content using the latest Microsoft Edge browser and web technology... </summary>.. <summary>.. WebView2 enables you to host web content using the latest Microsoft Edge browser and web technology... </summary>.

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35280
Entropy (8bit):	6.325467316141879
Encrypted:	false
SSDEEP:	768:2TFzTl1XWYTAePHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6LsubIOzXkSLA6XX/:2TFPHXnPHZDgcE05P4JjrnawSosu71JR
MD5:	2FB1A39DCC9F7311CC2F13C8676325C0
SHA1:	780E7501BB4EEC1D29BEF374442F9697F4403A55
SHA-256:	8BABA0E4A72823E75750FE9F3C92EDACD92BF1771CFF353885F79146C018FCCE
SHA-512:	5C5442D5CFE87B53EB500D14536FFA651F0AC8FB33B4F9A7B5AA7ECBD6C3A751F7940C970EBE6CAAC45C99B5C4BA6E647C3826E49E7D6596E09BA501F415C77E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....UI..........." ..0..X...........v... ........... ..............................N.....`..................................u..O....................b...'...........t..8............................................ ............... ..H............text...$V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........3..T=..........(q..@...ht........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{......#.......?}.....(....}.....(.....(S......(..... . ...(......,..(....,..(....,...(.....{....,..{....o......( ...*.0..>.........( .....}............s!...("...........s!...(#....{....,..{...........s!...o$....{....:.....(#......H...s%...o&....(#......G...s'...o(....(#......J

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.WinForms.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	30837
Entropy (8bit):	4.664180944660611
Encrypted:	false
SSDEEP:	768:3xJyiPmxW3uyCG4yCGdryCP1OQPpRJFXCfPJehIflP3c1VaGrjP+9cIeL3mk1xKe:3xJyiPwW3uyf4yfdry21OQPpRJFXCfPE
MD5:	FC5746829C51E8F61D2E1BA01DE3F39A
SHA1:	9E1B6EAC8974D4C733644313E637C2E4C4A9BD24
SHA-256:	6317641B65D19BFDE590FBB93A3ADBB88C8A2CCA3F5038912D9FC2A18DA3DEE2
SHA-512:	E7EDDB7CA4D66389001E04B01CE6A0C5DA5A792B26309B98C9CDE20F8F67DEC231958337704431C00F216FDADF3BD03DBD2D0454058C3F4DFFBB510763641B20
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Web.WebView2.WinForms</name>.. </assembly>.. <members>.. <member name="T:Microsoft.Web.WebView2.WinForms.CoreWebView2CreationProperties">.. <summary>.. This class is a bundle of the most common parameters used to create a <see cref="T:Microsoft.Web.WebView2.Core.CoreWebView2Environment"/>... Its main purpose is to be set to <see cref="P:Microsoft.Web.WebView2.WinForms.WebView2.CreationProperties"/> in order to customize the environment used by a <see cref="T:Microsoft.Web.WebView2.WinForms.WebView2"/> during implicit initialization... </summary>.. <remarks>.. This class isn't intended to contain all possible environment customization options... If you need complete control over the environment used by a WebView2 control then you'll need to initialize the control explicitly by.. creating your own environment with <see

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39848
Entropy (8bit):	6.248013095044449
Encrypted:	false
SSDEEP:	768:BzXGuETke7fYB3b1K8wDP/ryEH0mBO4JjrDXh2jUfUPLkq7FKKa5/Bi/hGvoAb0m:1X0t7C3JK8wDP/ryEH0mBO4JjrDXaUfV
MD5:	DA51131FDE22E5D412AE475F2CD28142
SHA1:	40D58BC78A29ADE39BDFC3F9BD3EF14ACEBC0306
SHA-256:	BEB930C0EE24EC6DFDA5390E1877EAB80BDFFFC7D582A12105EB8331B0543769
SHA-512:	76B2265EC3896CBDB8F05B7B5E470BC39C474016305E2C2385163E9894E265D8A6604E880F819587C5719E1F9063244218A242737DD902EC6617DF0010132E9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|............" ..0..p............... ........... ..............................._....`.................................9...O....................x...#..........d...8............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............v..............@..B................m.......H........;...M..............@............................................(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.P...(.........(............s....s....(.........r1..p.P...(.........(............s....s....(.........rO..p.P...(.........(............s....s....(..........(.........{...."..}....&(.........{...."..}....*..0......

C:\Program Files (x86)\Bot Master\Bot Master\Microsoft.Web.WebView2.Wpf.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	73847
Entropy (8bit):	4.693543823168815
Encrypted:	false
SSDEEP:	1536:xxpyIP0mLC4uyD/D4yDC4dryG1fPfyl8h/PbxPOZIaPka4PL1uhui1bKnOCfIPr1:xxpyIP0mLC4uyD/D4yDC4dryG1fPfylB
MD5:	5C6A3A21E42E46AA58DAE2714735D751
SHA1:	EB69BA187ECB40538338CECEB65718D536998046
SHA-256:	B06E9083133388501484CAD2CA6EEDCA452184DC6BF9321316835D45C93682C0
SHA-512:	686B707E895AD2380D7FABF4DCD446DC34EBBA4407C501B888B378B40FBEA1BCE75825B0D5C9C8D0979856E49F43ABB14DBA8F5B23B8EAE044E615A4AD88156F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Web.WebView2.Wpf</name>.. </assembly>.. <members>.. <member name="T:Microsoft.Web.WebView2.Wpf.CoreWebView2CreationProperties">.. <summary>.. This class is a bundle of the most common parameters used to create a <see cref="T:Microsoft.Web.WebView2.Core.CoreWebView2Environment"/>... Its main purpose is to be set to <see cref="P:Microsoft.Web.WebView2.Wpf.WebView2.CreationProperties"/> in order to customize the environment used by a <see cref="T:Microsoft.Web.WebView2.Wpf.WebView2"/> during implicit initialization... It is also a nice WPF integration utility which allows commonly used environment parameters to be dependency properties and be created and used in markup... </summary>.. <remarks>.. This class isn't intended to contain all possible environment customization options... If you need complete control over the e

C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	700336
Entropy (8bit):	5.9289057284451445
Encrypted:	false
SSDEEP:	12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
MD5:	6815034209687816D8CF401877EC8133
SHA1:	1248142EB45EED3BEB0D9A2D3B8BED5FE2569B10
SHA-256:	7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
SHA-512:	3398094CE429AB5DCDECF2AD04803230669BB4ACCAEF7083992E9B87AFAC55841BA8DEF2A5168358BD17E60799E55D076B0E5CA44C86B9E6C91150D3DC37C721
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................f....`.....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........z..<&..................<.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{[....3...{Z......(....,...{Z.....{\.......-.....0...........-.r...ps....z.o......-.~....*.~....X...+....b..

C:\Program Files (x86)\Bot Master\Bot Master\Newtonsoft.Json.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	707721
Entropy (8bit):	4.633098680643138
Encrypted:	false
SSDEEP:	6144:XqqUmk/RikFaG0rH3jGHdl0/IBHNpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUn
MD5:	AD1A946CDBE4FC83907CF558FB80A37F
SHA1:	9B6AB559CCCCE89E989259E356C55BE6E370F1DB
SHA-256:	E3C9CB0CBF4B3BE20B6030F3A4872EDD81E042048D2D19732EAC3EEB9779DC0B
SHA-512:	3BBBD262F3FC669BB0709963788CCCA67E17FE28828FF72CA32F1D6D410A3CF76950D126FEB39F204163EB5B43B07F54BC1DD4DF7F4132933DBB61C054E9C1E0
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	6.425485073687783
Encrypted:	false
SSDEEP:	384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
MD5:	ECDFE8EDE869D2CCC6BF99981EA96400
SHA1:	2F410A0396BC148ED533AD49B6415FB58DD4D641
SHA-256:	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
SHA-512:	5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Program Files (x86)\Bot Master\Bot Master\System.Buffers.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (727), with CRLF line terminators
Category:	dropped
Size (bytes):	3481
Entropy (8bit):	4.808701688265429
Encrypted:	false
SSDEEP:	96:1Sm9iVH4cK4bSrh4st9Y9TS7AilqqZw37EeKB+ZPZk:1Sm9iecnWrue8ildZw3QD+ZPZk
MD5:	1C55860DD93297A6EA2FAD2974834C3A
SHA1:	7F4069341C6B62ECFC999A6C2D8A2D5FB59D44F6
SHA-256:	2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578
SHA-512:	37FA5D4553CA3165F10E2FFEF38FEFC0DBA4A2DBFA05AB9F09AB87B5F71F30E6D965D2F833F58B50B3BC2529EBE8FB5CC431C264F7B47AD026F5C5A874A6ADA1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Buffers</name>.. </assembly>.. <members>.. <member name="T:System.Buffers.ArrayPool`1">.. <summary>Provides a resource pool that enables reusing instances of type <see cref="T[]"></see>.</summary>.. <typeparam name="T">The type of the objects that are in the resource pool.</typeparam>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create">.. <summary>Creates a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. <returns>A new instance of the <see cref="System.Buffers.ArrayPool`1"></see> class.</returns>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create(System.Int32,System.Int32)">.. <summary>Creates a new instance of the <see

C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141184
Entropy (8bit):	6.115495759785268
Encrypted:	false
SSDEEP:	3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
MD5:	6FB95A357A3F7E88ADE5C1629E2801F8
SHA1:	19BF79600B716523B5317B9A7B68760AE5D55741
SHA-256:	8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
SHA-512:	293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Program Files (x86)\Bot Master\Bot Master\System.Memory.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13950
Entropy (8bit):	4.749162715500682
Encrypted:	false
SSDEEP:	192:19SSrAVfjSE0wxiMiLiLiXdCjticiciAiJiziPNjNei5i9zhi+ipOUTJ:1gbXKKXppPmcPi6LmJ
MD5:	ADD19745A43B2515280CE24671863114
SHA1:	CF44E6557FDE93288FF2567A002A69279965CABA
SHA-256:	D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813
SHA-512:	8D7E564FA61411B5C28F29B07855DD112687EDCB39B991803C7C7DE67B6894B309102AC9B52409B56B7BB5C9101EB4CDFB21FCFBF5D835E4A153E188CB97CC87
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Memory</name>.. </assembly>.. <members>.. <member name="T:System.Span`1">.. <typeparam name="T"></typeparam>.. </member>.. <member name="M:System.Span`1.#ctor(`0[])">.. <param name="array"></param>.. </member>.. <member name="M:System.Span`1.#ctor(System.Void*,System.Int32)">.. <param name="pointer"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32,System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.Clear">.. .. </member>.. <member name="M:System.Span`1.CopyTo(System.Span{`0})">.. <param name="destination"></param>.. </mem

C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115856
Entropy (8bit):	5.631610124521223
Encrypted:	false
SSDEEP:	1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
MD5:	AAA2CBF14E06E9D3586D8A4ED455DB33
SHA1:	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
SHA-256:	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
SHA-512:	0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Program Files (x86)\Bot Master\Bot Master\System.Numerics.Vectors.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	183484
Entropy (8bit):	4.7848212109760935
Encrypted:	false
SSDEEP:	1536:azQgQfMzpKGPqMGFY3lF8YzA2HrYJtJZJ9JaGf4AscoqrbuC4BqaiaIacasa7c1E:azafMDl4LfX3MIg+QDB
MD5:	95DD29CA17B63843AD787D3BC9C8C933
SHA1:	1A937009A92B034EDB168CFAC0EC1C353BE8F58E
SHA-256:	AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
SHA-512:	8E9397816D3435CCF79F1BF07B482473A7DD3B570BCE003639F2E9FA1C5FE31C4B9400B68F191A36251A59C0253EF9E09039FDD63BA2205D379B3C582E603499
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Numerics.Vectors</name>.. </assembly>.. <members>.. <member name="T:System.Numerics.Matrix3x2">.. <summary>Represents a 3x2 matrix.</summary>.. </member>.. <member name="M:System.Numerics.Matrix3x2.#ctor(System.Single,System.Single,System.Single,System.Single,System.Single,System.Single)">.. <summary>Creates a 3x2 matrix from the specified components.</summary>.. <param name="m11">The value to assign to the first element in the first row.</param>.. <param name="m12">The value to assign to the second element in the first row.</param>.. <param name="m21">The value to assign to the first element in the second row.</param>.. <param name="m22">The value to assign to the second element in the second row.</param>.. <param name="m31">The value to assign to the first element in the third row.</param>.. <param name="m32">The value to assign to the second element in th

C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18024
Entropy (8bit):	6.343772893394079
Encrypted:	false
SSDEEP:	384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
MD5:	C610E828B54001574D86DD2ED730E392
SHA1:	180A7BAAFBC820A838BBACA434032D9D33CCEEBE
SHA-256:	37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
SHA-512:	441610D2B9F841D25494D7C82222D07E1D443B0DA07F0CF735C25EC82F6CCE99A3F3236872AEC38CC4DF779E615D22469666066CCEFED7FE75982EEFADA46396
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."..h$...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v...#.;.-.h.......0..#.....a5\|T%W...].!.%'..9.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0...............*...0..............

C:\Program Files (x86)\Bot Master\Bot Master\System.Runtime.CompilerServices.Unsafe.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20529
Entropy (8bit):	4.731043104619016
Encrypted:	false
SSDEEP:	384:Y/uXukudyvmB0fmkcdZKyQe1EyriJriurs8rsF9vVwFaFDJOeOtOEKFzUxRkj1r:Y/ApEwmafmkcdZbQe1EyriJriurs8rsR
MD5:	C782E92ABBFC0531226F735C6AC56498
SHA1:	2586FDBEB6D1E11D4CECD5B3E8387A18C7B4D350
SHA-256:	39C2D4A63A186D423E9C866F4D3E9A6ACBA0103398F20BAF8B92A38744894215
SHA-512:	A12B6807695C9C626DE9602ABC6DF72BCC5E869A29C7111E956034F321436E7C50EA36ED5EC5B6F93A639AE0F7AEA93953E91AE557BF423A749B036C7252A7B9
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Runtime.CompilerServices.Unsafe</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.Unsafe">.. <summary>Contains generic, low-level functionality for manipulating pointers.</summary>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.Int32)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the offset to.</param>.. <param name="elementOffset">The offset to add.</param>.. <typeparam name="T">The type of reference.</typeparam>.. <returns>A new reference that reflects the addition of offset to pointer.</returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.IntPtr)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the of

C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76904
Entropy (8bit):	6.044596523315333
Encrypted:	false
SSDEEP:	1536:HOOuOOOoODVoXY9BnEf8uOxvW8hYEWroNFMRwkTuMd:VDGXmnEUuOx+8KEWrobMRzuq
MD5:	BA1AF3BBFF4D457B6D3F730234C3C701
SHA1:	1B75BC14DAA093502C7C5814852928E28AB6659A
SHA-256:	78EB5B4FEE580E163D1BEA1FDB7D371FDFCFD30ACD8708FF62C4372AAA219F7C
SHA-512:	51895C9B0EDE088B034C581AB4574A36F80E41F2B04186B3C066B6D72DA85680E00EA5E07DC9C89DB7D997C1AD3D9686ACCDC827859EAAB2918376C4C9E469B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............v.... ... ....... .......................`............`.................................#...O.... ..................h$...@......8...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................W.......H........l..T...........0.................................................('.....('.....('...^.('......7...%...}....:.('.....}....:.('.....}....:.('.....}....^.('......8...%...}....:.('.....}.....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X((.....R...((.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X().... ...._.S...().....d.S..0..&.........+....(...G...Z.(......X....(+...2.*...0....................(+.....1...(+....Z.9.....(...+

C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Encodings.Web.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators
Category:	dropped
Size (bytes):	62941
Entropy (8bit):	5.113786858273216
Encrypted:	false
SSDEEP:	384:Yc32SgYGYofQhYLJkiBkN3/Ky7pkG05HaTwoIIMZpq/YbTbBnRE1Cd8PBdl+Y0TE:Y9fJvkNxwoIIMZxE1Cr0Md3wh7te4
MD5:	ACC8AF8D28DC65488D1C49DEFD8EA153
SHA1:	1EECE92A2F2E40DE4AFB43F7A5CAEC9A3B384B87
SHA-256:	0772B7895A1FEA1D3BBEE2ED2F5200EF4F9EB38B22C3D00B5405325BE9D8A7CD
SHA-512:	452669AFF783AC248394838083695BD6CE45CB1B41FC512C7F3C7039D49D9E40C24F51A2255BAE3AC6F2E01388A54EC1F17092566CE808C70F3FC599ADA9734A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Encodings.Web</name>.. </assembly>.. <members>.. <member name="T:System.Text.Encodings.Web.HtmlEncoder">.. <summary>Represents an HTML character encoding.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> class.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.Create(System.Text.Encodings.Web.TextEncoderSettings)">.. <summary>Creates a new instance of the HtmlEncoder class with the specified settings.</summary>.. <param name="settings">Settings that control how the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> instance encodes, primarily which characters to encode.</param>.. <exception cref="T:System.ArgumentNullException">.. <paramref name="settings" /> is <see langword="null" />.<

C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	513128
Entropy (8bit):	5.971511220770579
Encrypted:	false
SSDEEP:	12288:heoAhNgjkMq00CYjhlfKtgYytHVZ8kJ5LXrB+kSo/Y6dHC5tbRktxi/UE:hdAhNgjkMq00CYjhlfKtgYytHVZ8kJV4
MD5:	0894F9DB9EFAF98FF96625A7553806A4
SHA1:	19A983154516BB9542566B80F214AEC4657935DE
SHA-256:	E51AB157565C648CCDF3B003937FE991ABDD1A03E53A7E58BA1F6505097CB082
SHA-512:	27540D1F49D543C961DB74EE35C41575E0BB4AC7BBC1A6FADAAFA7509C819BEEE0DDA525CD3978141327043DDD63378EDA83FD9566DE9623D46847814D195B3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............B.... ........... ....................... ............`....................................O.......................h$..............T............................................ ............... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................!.......H............>...........U...f............................................(H.....(H.....(H...^.(H..........%...}....:.(H.....}....:.(H.....}....:.(H.....}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(I.....R...(I.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(J.... ...._.S...(J.....d.S..0..&.........+....(K...G...Z.(......X....(L...2....0..............n.....(L.....1...(L....Z.......(...+.+...(L....Z........sN..............

C:\Program Files (x86)\Bot Master\Bot Master\System.Text.Json.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	457799
Entropy (8bit):	4.895083548380783
Encrypted:	false
SSDEEP:	6144:rKbxzXvvHMtFJWxEXjqM6xwFHibdBvYJgP4aqKiO6z0GYQYEu:VtFXjqNwFQ
MD5:	48DCE2A80E6612C98E895CCCFFDFDD06
SHA1:	6FC93E474AA32491BCB53A1A9DC1BC1C40B23F3A
SHA-256:	8499B6FFB77447FCB124DBFD0964E92267E14B3796A27FFC62A1B0FF04340575
SHA-512:	17FC851264162A29D3D36F6622A66DCD7CF435CDEE862DF86CDC0976357A126944775C538A5B8A25E9A385CE36C07EA73FE2BE5275EECF3C0F57044C063C2194
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Json</name>.. </assembly>.. <members>.. <member name="T:System.Text.Json.JsonCommentHandling">.. <summary>Defines how the <see cref="T:System.Text.Json.Utf8JsonReader" /> struct handles comments.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Allow">.. <summary>Allows comments within the JSON input and treats them as valid tokens. While reading, the caller can access the comment values.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Disallow">.. <summary>Doesn't allow comments within the JSON input. Comments are treated as invalid JSON if found, and a <see cref="T:System.Text.Json.JsonException" /> is thrown. This is the default value.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Skip">.. <summary>Allows comments within the JSON input and ignores them. The <see cref="T

C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:	384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files (x86)\Bot Master\Bot Master\System.Threading.Tasks.Extensions.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10147
Entropy (8bit):	4.891178331598223
Encrypted:	false
SSDEEP:	192:1/elWY3f207pbNcYDLna8MMOOXzHMfHuHoLob+OoMuJkfYSiffiWje0seJme0seM:1/2d207pbNc2na8MMOOXzHMfHQoLob+N
MD5:	C89E735FCF37E76E4C3D7903D2111C04
SHA1:	3C0F1F09C188D8C74B42041004ECE59BBD6F0F56
SHA-256:	975A9555F561B363C3E02FD533F6BF7083AA11BBC7CBF2B46C31DF3D3696B97B
SHA-512:	DEBDD8D0ED2FF6AD7B175ACFEB1681B1A68EEEDD6D717E20E6AC5E0D11C13A1219B4D60F9319939C63BF4B53456328531369F4A9FFF5B201475858310E385007
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Threading.Tasks.Extensions</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.ValueTaskAwaiter`1">.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult">.. <returns></returns>.. </member>.. <member name="P:System.Runtime.CompilerServices.ValueTaskAwaiter`1.IsCompleted">.. <returns></returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.OnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.UnsafeOnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="T:System.Threading.Tasks.ValueTask`1">.. <summary>Provides a value type that wraps a <see cref="Task{TResult}"></see> and

C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25232
Entropy (8bit):	6.672539084038871
Encrypted:	false
SSDEEP:	384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
MD5:	23EE4302E85013A1EB4324C414D561D5
SHA1:	D1664731719E85AAD7A2273685D77FEB0204EC98
SHA-256:	E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
SHA-512:	6B223CE7F580A40A8864A762E3D5CCCF1D34A554847787551E8A5D4D05D7F7A5F116F2DE8A1C793F327A64D23570228C6E3648A541DD52F93D58F8F243591E32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.............b2... ...@....... ...............................H....@..................................2..O....@...............$...>...`......x1............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................B2......H........!..T....................0......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2r[..p.(....B.....(.........*.BSJB............v4.0.30319......l...4...#~..........#Strings....t.......#US.@.......

C:\Program Files (x86)\Bot Master\Bot Master\System.ValueTuple.xml

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.391770241438592
Encrypted:	false
SSDEEP:	3:vFWWMNHUz6GbC/0tFFNu7WRtLz3hAbS9/FFNrGMH/xtgGM8Xby:TMV06GbSWVVR+SXNffgp8Xby
MD5:	B6E60687AE5DB6D011E21E6993620745
SHA1:	B117C6BBDDC72E7F4B590173992EE17BFDDE4BE1
SHA-256:	C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
SHA-512:	709212B6CB36F57B92A82DEF810F9C075A91B3E6A5FD330DCFB563D94A320783509441347D63BDE97F530C6B10CE6AA769CA11F7FC39ACF1B25D5C8F9DCBB389
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.ValueTuple</name>.. </assembly>.. <members>.. </members>..</doc>..

C:\Program Files (x86)\Bot Master\Bot Master\Uninstall.exe

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119808
Entropy (8bit):	6.3234870718793195
Encrypted:	false
SSDEEP:	3072:NWmoWcZQfmGltwBiJWSIrRM7DcVfu7o4r:NWlWcZQfQisDKDcV27t
MD5:	7AE89C6074B7CF3D03081EA6616D873B
SHA1:	7294758911932FF6885521103BAF631ACBDA21BC
SHA-256:	AE326F86AA8BBB88831B0339C820859467EF910DADED5B430DC88DA97D203772
SHA-512:	B33EBAB1F4446CE2E339E1D9C6D781BAEB2104A97FF098DAE384FEDF98FC2FEB752B8231F1D33F0AAFBB757F48DA7BD7D1924FA0F8C2ED7A188A6AD984FB7C21
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t._S...............2.8...................`....@.....................................................................................D...........................................................................t................................code.../........................... ..`.text...`$...0...&.................. ..`.rdata.......`.......<..............@..@.data...xm.......d...X..............@....rsrc...D...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\app.publish\BotMaster.exe

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2941952
Entropy (8bit):	4.368119490757434
Encrypted:	false
SSDEEP:	12288:fhx7siRe9fEtTMd+8MIKJEz8Jfy5/uYSuwCV8YB09YnlzQ:fXDkxEtgc8PKuaCVHZl
MD5:	895F3A548FD8FA6FD1355AF6D218DA2C
SHA1:	F45065862543B4834B525AC235672D4B11F67EC9
SHA-256:	14A2312F1485E3B0ACD96127083BCA19DCA2988842DAE4928F7EDFE6CB2B47C4
SHA-512:	55DC3094822C57562C9761DC66B79799B5CFD1829AE81B82AE6AD5ECF545D1E5A11D7B522B182046FB98920D4CEE6E8106DB45ED8BFCF53FBEF6CF8AFE3EC774
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..d.........."...P..2(.........bP(.. ...`(...@.. .......................@-...........`..................................P(.O....`(.p.................... -......N(.............................................. ............... ..H............text...h0(.. ...2(................. ..`.rsrc...p....`(......4(.............@..@.reloc....... -.......,.............@..B................DP(.....H............................G...........................................0............("...(#.........(.....o$.........................(%......(&......('......((......()....N..(....o....(....&..(+.....s,........s-........s.........s/........s0............0...........~....o1....+...0...........~....o2....+...0...........~....o3....+...0...........~....o4....+...0...........~....o5....+...0..<........~.....(6.....,!r...p.....(7...o8...s9............~.....+...0......

C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-arm64\native\WebView2Loader.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	127912
Entropy (8bit):	6.024496413707989
Encrypted:	false
SSDEEP:	1536:FloHrOPzv4t1hmtcGXrGv8QitveGIsWLdgVWTF9EtzeW+CzX3i:FloH67v4tCe42G4gVWT/Et6WTbS
MD5:	0A21E14E0999C7E5AE8A74E6895AD694
SHA1:	F33769B32EF692360875347BFA5050FA69402617
SHA-256:	DAC2C67E5A21BA0A40A1A3ECDC9B7723708F10F5ECAB26F2DDB729C2E27396CA
SHA-512:	218D54CEE7ADC3A1C2578DF7BDEB95766EC97E602E3A381FE8E3DE5E33478FB9ECE71666DD4F1DB2416279F46A34B8BFDA5831930A2251256628162526B4A1E8
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....'b.........." .................M.......................................0......f.....`A........................................i.......[...(............... ........#... ......L..........................(...01..8.......................`....................text...@........................... ..`.rdata.......0......................@..@.data...............................@....pdata.. ...........................@..@.00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x64\native\WebView2Loader.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	141224
Entropy (8bit):	6.131071018313368
Encrypted:	false
SSDEEP:	3072:JVl3u395AFm23fMZamo5Ha/9V8mgg2esFTGEtBnezYSi1g:lYAFmKyazpa/9JBEtUz7
MD5:	72CC22CBDEE3A60C042D0EACFAC7FED9
SHA1:	CBEFAAEA857FECD3EFC42E983B63F91F0FEF6F96
SHA-256:	184574B9C36B044888644FC1F2B19176E0E76CCC3DDD2F0A5F0D618C88661F86
SHA-512:	CBD49DDD2D9B613B439A5FC7426ABFF32678D358EC91271F50B525FDD382297538EA1C91CA74FF4390CCC8A4C4A2B617B77E318AD1F3042A3B41A4F4DE1AA258
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....'b.........." ..... ..........0D..............................................5h....`A....................................................(....`...................#...p......d...8.......................(....1..8...........`.......(...`....................text...5........ .................. ..`.rdata..\|....0.......$..............@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@....voltbl.>....@.........................._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\runtimes\win-x86\native\WebView2Loader.dll

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110504
Entropy (8bit):	6.4357259807044045
Encrypted:	false
SSDEEP:	3072:UykiJ1Z1K95jvS8BBw/qZqocqQThEt9WSt6MlNMl:zkiHTMBBaNEtUS9lNMl
MD5:	CE8EAE228C99ECD86B3037288691D0B9
SHA1:	E3C45F525BADA976BED38C8A3E9492D6FF2FC9BC
SHA-256:	D493120AFE447E1BFE78B40FD0CEE82549009E39F999DA2F52B565DCDF69E7D5
SHA-512:	848751125F008722B4391DCAF71ECDAEB6456F007B2796D613F2F07B7F176F6697D62D18752DB0675AB70AD1E7C237C0B7655F553820D8309300BFE1B0E54886
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....'b.........."!................@>....................................................@A........................M_......?`..(........................#..........D\.......................Y......`................a..<....]..`....................text............................... ..`.rdata...n.......p..................@..@.data........p.......d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bot Master\Bot Master\uninstall.dat

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	data
Category:	dropped
Size (bytes):	4617
Entropy (8bit):	5.063666968117584
Encrypted:	false
SSDEEP:	48:e8lCMzCKDiIQlCLC7JCfCgqCBZCZVZGZRZ+Z5ZyZlZHjZHwZHdZHKZHHZH8ncv0w:LH+aM3QDoL8H1qf0ZdkUYa
MD5:	E5AE2B499F02906D83620661D0FCCECA
SHA1:	EADB379FF8C8130D54CA3B76EBB8DBEE7064D86B
SHA-256:	7F21A33C61C7BA001CDDD9B22D1C2AD08B6265F4848A5C2774A42E7231E956A3
SHA-512:	C71D03B6B6B867DAB561ADD820E601AF58717C00634022A6A7B934F85E06D4062DE50B277943E812B0AE5E6C4CEFEE0EDA9BAE5AADC030622548A188BB6DBA95
Malicious:	false
Preview:	....Bot Master..5.8....C:\Program Files (x86)\Bot Master\Bot Master\..9...#DF..C:\Program Files (x86)\Bot Master\Bot Master\app.publish\BotMaster.exe..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.application..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe.config..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe.manifest..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.pdb..#DF..C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.xml..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Languages\English.json..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Languages\Espa.ol.json..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Languages\Fran.ais.json..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Languages\indonesia.json..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Languages\Portugu.s.json..#DF..C:\Program Files (x86)\Bot Master\Bot Master\Microso

C:\Program Files (x86)\Bot Master\Bot Master\uninstall_l.ifl

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3006
Entropy (8bit):	4.906329518650122
Encrypted:	false
SSDEEP:	48:KSH5mNWUm8/7UzY8Dmwwn0VYNv7TO4L/kpLlpfX9+XD/Vyx2IBGG+KX2ihd8rdpF:bZhUP/7UURn55Tf/ipX9+XrVmRtX38
MD5:	DC51022CF78C9B519F2058983A773119
SHA1:	56BF6AAE50122301617CDAA7C5002C38FA1571A1
SHA-256:	93E28A5125B4864773F53D1C5F87C1756EFA0C2D60D5C3FD6B34AA920080F568
SHA-512:	DFAC8474BF7724B000A530B76152F75E146AE490D7F3D1F4960247226663EF738C88000A2B3C033BF626348DB4B33D7B26E0202B840052D80FF6C36BB8E089AA
Malicious:	false
Preview:	//(C) 2006 Forgesoft..//English language file for InstallForge.....[Main]..Title=<appname> Setup....[Gadgets]..NextBtn = Next >..CancelBtn = Cancel..BackBtn = < Back..FinishBtn = Finish..BrowseBtn = Browse.....AcceptOptn = I accept the agreement..DoNotAcceptOptn = I do not accept the agreement..CreateDesktopIconCbx = Create desktop icon..CreateStartMenuFolderCbx = Create start menu folder..LaunchProgramCbx = Launch..RebootCbx = Reboot computer now..DestinationFolderFR3 = Destination Folder..SelAppFolder=Select Application Folder:..SelStartMenuFolder=Select Start Menu Folder:....[Messages]..ExitSetupH = Exit Setup..ExitSetup = Do you want to abort the installation?..CouldNotExtractFileH = Error..CouldNotExtractFile = Could not extract file!....[Start]..Title = Welcome to the <appname> Setup Wizard..Text = This will install <appname> <appversion> on your computer. It is recommended that you close all other applications before continuing. Click Next to continue.....[LicenceAgreement]..Hea

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307337024576366
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrH:KooCEYhgYEL0In
MD5:	BDF71D7BF5138654D52267051D9CF764
SHA1:	50F91D188AA1B894A892CFFA4269712546739AA1
SHA-256:	1B77415B3A5894212583A5AF922D5ED79492690BF3F0B9EB7087B0ED37E860BB
SHA-512:	4BE880F9F34B26C21E81E3ED10094C06DD89BA1EBE03AA2B3CDF352A0D2A8470B0B44B446CAFB803AF9F95466B646BD50B67C4C8E1D883826409DE52952FB7EC
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3bee8421, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221067874410847
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	2C531EFE947B76FFD9312D2F8B67BC36
SHA1:	4B6E2752EB5F414940C0994B25C1B055E6C0BB51
SHA-256:	D888786C2F3848AF1A2E3232AAAABB92285961A426CF5CC7DD26A1D48E515778
SHA-512:	913E5665820E4D1E31BA2ABF245E4954CB563362F50B2EA2D0DF7E8E5CE636ADD8C35039B01E52154CEA8DC42A2BE16DCB20D3BB19029B24A21EFFCAC3DE193B
Malicious:	false
Preview:	;.!... .......A.......X\...;...{......................0.!..........{A......\|!.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...........................................\|....................%.....\|!..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07556428250951303
Encrypted:	false
SSDEEP:	3:h6YeSezqlvjn13a/4evLxltallcVO/lnlZMxZNQl:h6zilv53qFv4Oewk
MD5:	57C4F866974DCC4E295B1A7A3BF9B231
SHA1:	6A125D6E4B91B604C45121FF664638AF14CE91B6
SHA-256:	4A6C858498979F2B4F4957A7F00E995AB8E821F6A0AE2250A3913703BFCA9487
SHA-512:	472650D752DC7B4585DC238D769C660D5A64E388A079AC10E988BE0BABB0BFE6EE752C8022672E0AF0FCBFFE2018699928F8A053BAE3056201F3659AE715362B
Malicious:	false
Preview:	.?'.....................................;...{.......\|!......{A..............{A......{A..........{A]..................%.....\|!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe.log

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.364163817184007
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzeRE4KoE4Tye:MxHKlYHKh3oRAHKzeRHKoHx
MD5:	A870F03168B188356C8FBC8D502E6A89
SHA1:	ABC920842CA8668B032F51C022FB73469D6629A2
SHA-256:	FD4C5A3EF3E80437E613914B88BFDC209997AF75A071DADB12C231E798DDB387
SHA-512:	2B2C56CC8307A680A6ACDA13267D94D5550FD6263C36DEC324A5F6DEA3606969DFE6C416F3D624DAAE30D8EFB709576FA3F81485725800196564CF59AF5348D9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinUpdate.exe.log

Process:	C:\Users\user\AppData\Local\WinUpdate.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.345265452111628
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhayoDLI4MWuPrePEniv:ML9E4KlKDE4KhKiKhRAE4KzeR
MD5:	9A0010B54E25DD22EC1D9FA3EA1AE6C2
SHA1:	830D8D4D0BD0544B1F25ECF4303C40479CF677C0
SHA-256:	B3D9F4BEFE0FF83AEC0AA7CCFB542E0B9CED36756FBA1BA863606969F3360F56
SHA-512:	6DEBC5BFC689C19AD8B72264FDD3710C93A2C2E5344E8024502B2D3E7554BC80381CE2A7BB4D560EB8F3E5E0C73195D07839651FE8CEA6E27F9A2674ABFF6691
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XClient.exe.log

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	311
Entropy (8bit):	5.347482639021185
Encrypted:	false
SSDEEP:	6:Q3La/xwchA2DLIP12MUAvvr3tDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hhpDLI4M9tDLI4MWuPTAv
MD5:	1AC8524D3800CDD5A91A864BCD4C3AB5
SHA1:	D003AEE44AC954938CE83E4A80412E04F726EA83
SHA-256:	8652A0399D65C2D111841F66EF2E930CDB8291CC8203252D59FD4921FF336C02
SHA-512:	9F28B59B99D0BC1EB60D29BE54CE2DAAC7D9B5D895311169578383C19A46CCF7CDE498EB6D7F172CF7D1D11E5B16665DF989CD8EEC527282BE3B796CD08C7DAC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.853758728823711
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzpxl9Il8ueQB6FpF3/Mlugsld1rc:modYvB+pFPMlubu
MD5:	BFDC6B8B58F01C8307C5FDE45111FE84
SHA1:	8CAB704C2328BDD62146B7978612FFA72D85B792
SHA-256:	3E8FBA11E3953B182C17EE81481FC84C69129240A6C87B5411084D80DF582C4A
SHA-512:	6E2D921F9CB032D635B110E6FC7FD881BF46A355AC73A6A453383C7FDC0B2DBAAAF66E1FE1D9D78441F8ABAAE05A118506DB23485A153AB780BDD5CAE4F2FC89
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.D.o./.x.B.B.z.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.H.j.I.C.2.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379427857998973
Encrypted:	false
SSDEEP:	48:FWSU4xc4RTmaoUeW+gZ9tK8NPZHUxL7u1iMugei/ZPUyus:FLHxcIalLgZ2KRHWLOugss
MD5:	53FC94E7BB6CC6B136A4F0747ED3570A
SHA1:	D3CE41C5615B80897F8744A1AF7980DDF940A3F3
SHA-256:	BA69B3EC9FB6A7A4F4FB616BA8A75FE727B9A84DE4EF55F44566E067E9F60F9D
SHA-512:	F2DABACADAE49D4F93E7F1A08B73F21F003E02BF01F50F729C72AD866FEC4D52C4A829F83B988C704E019C7528335FEE8F7F0E7B450FE8E341BB15C4EDDD39D5
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.ConfigurationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\4ad3e0b3-5c3a-4efc-9ee2-7d7fb75be9fc.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	PNG image data, 560 x 315, 8-bit colormap, non-interlaced
Category:	modified
Size (bytes):	16259
Entropy (8bit):	7.968675746259537
Encrypted:	false
SSDEEP:	384:SsAikOggeC536WiWxFu1WwOzEiraismFb:STik1gv16WnxFsWwdirVFb
MD5:	0C6EC69B054FDEB31CF3E5E10290FD8E
SHA1:	5B2D2EF0E3B5824ADDCC34D642769F5F14671411
SHA-256:	D980AB372658F4C7C8F07D730EF6DC67E3FB3471F37928274F915C0308850994
SHA-512:	61947EEFDEFDC94654991E00DE1045CA1E781B69FE1C7305614735926E256F007368F3E904207C8612E03D09E904E03B2A69A4CB297672A49952B2DDA5459CA1
Malicious:	false
Preview:	.PNG........IHDR...0...;.......K....$zTXtCreator....sL.OJUpL+I-RpMKKM.)..Az..jz......pHYs.........O%......PLTE...222..~.....................111...3339;?....% ...344<>B;=A./0......78<......000OPRwwwtyzggi;;<CEG......]^a...him%&'.....................')+.......#............~~....555.........>>>SSS...ABE.........888...+.FGK...eeg..._`c......??C.....abe...W..XY\...............???UVZPQU...LMQ............[[^.. JKNu{\|559...mnq..........klo........~.........stv... !#...TUW...\|\|}......ppt..........'.............."#&.........................ist......{......b[QTWkxy.....::=........................^ij.......................ITUw........,67!-.0;<bno...Yde...&12...a..^........ ..P[\.&'............T`a.....DNOn\|}6FG......;........>JKL.....~..6ABb..C.....+........=.~?QS......m....[.....C.p.....3..YR........}_.nN.]J...)%~.......v..6rk.....B.U5.Ij........2~2..[..,..;.IDATx...O....!.3........V\_..j.s..).....8.(8g..B..J...T....R.........V..t..f.(.Nr$....T.R$....'/....RJBx>~.."c

C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	3178277
Entropy (8bit):	7.914678146803296
Encrypted:	false
SSDEEP:	98304:va5GYryGYrMtWBJHU74Z9wqKOButZoGza:S5HGH8ob9wrZ7oGza
MD5:	C9C01FDC7D3AD84CEEB43C6B099A8AD5
SHA1:	2E7A67B2DD1A9BB2AD530A76868EC1636612C294
SHA-256:	F811DADCD0EC744B5927F4EB6B100BBEC8C6F03C13218BDDE25FA0F8A8FED056
SHA-512:	B58BE960EF3219FB0E9BA3A533DD1B26861EB7300526FBD3761EE21CFBFA77B86AC969FFF6EAAAF97B8B573AE684113E3DEB39A8C4A85C6CD7EA4F67A8386836
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...tN.W...............2.....................0....@..........................@..........................................................@h...........................................................................................................code............................... ..`.text...,........................... ..`.rdata...T...0...V..................@..@.data....3....... ...n..............@....rsrc...@h.......j..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\Desktop.dat

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.197209073300621
Encrypted:	false
SSDEEP:	3:YWi14jZY6xA4vXyU4jZY6E:YWicZY69XsZY6E
MD5:	F97AF9F76317A164E194D2ADB9A79F4A
SHA1:	A793EF80CA4620916FB0FF938A61C087E0794B75
SHA-256:	E96B37868F42BE735C6D9CD8FE937C154E3D93DC43A653DBCD1200937B6C1918
SHA-512:	268D1CD05527D178C9A5B51EEB1AEC4C2837823A088915D05B40A140791367ED569DACD222C901617CACC2B8E81DC4A988E1D512162BBDF415C660A91D5FE30E
Malicious:	false
Preview:	<installpath>\BotMaster.exe..Bot Master....<installpath>\BotMaster.exe..0..

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\Image_Left.jpg

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 8, image size 51496, cbSize 52574, bits offset 1078
Category:	dropped
Size (bytes):	52574
Entropy (8bit):	3.0903761385512687
Encrypted:	false
SSDEEP:	384:4BEdMSd1XtGxVej7fSXgWuZThHUfL1y80X/NisaihUzgsQYEq82FMoXZXzJzyoVw:xC01XtGSDr6puPnhicedJAGo9xScd7
MD5:	D4C6925A72BB9F71A5A9BC8FE2022F9B
SHA1:	AF89965F896BD744A8DB922DEE58BE9248603B6D
SHA-256:	C5D0EA0D4E4CCA82C72045AE40D0FFB68C6E9DE6304C3DFAA17D99FAB03E47E5
SHA-512:	303FC0D8FFACD8B4179112CF5B1143840826E629FF3583BBFC21ACE940D4468057E0472246C855118967A16A2CE5067D884DD31CEE24B7A489B6E82E1BD70ED2
Malicious:	false
Preview:	BM^.......6...(.......:...........(.......................3...f................3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f..................3...f...................3...f.................3.3.3.f.3...3...3...3..33.333.f33..33..33..33..f3.3f3.ff3..f3..f3..f3...3.3.3.f.3...3..3...3...3.3.3.f.3...3...3...3...3.3.3.f.3...3...3...3...f.3.f.f.f...f...f...f..3f.33f.f3f..3f..3f..3f..ff.3ff.fff..ff..ff..ff...f.3.f.f.f...f..f...f...f.3.f.f.f...f...f...f...f.3.f.f.f...f...f...f.........3...f................3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f.................3..f...............3...f.......................3...f................3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f..................3...f...................3...f...................3...f................3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f..................3...f...................3...f.........................................................................................

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\Image_Top.jpg

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	PC bitmap, Windows 3.x format, 55 x 55 x 8, image size 3080, cbSize 4158, bits offset 1078
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	5.5650658856515
Encrypted:	false
SSDEEP:	96:tTvuA1NlwGt6tzZe+6HWjKQR+jtuFWHKiw0zY:lvpt6bAH0zYjtun0E
MD5:	4AE65BA99FB788D962860EC9ED14F2A7
SHA1:	9D89FC4DF5CB45232C4F6B514855DE723D5B4809
SHA-256:	6D118DC765ED52458079F8F588B7E144B02AA8E564F06726AADE9CA7D77EF0A3
SHA-512:	A5D593F69F38E9907628B0AB8ECB7FF79AF0C8A0223B3FAD7D9ED7361FC3F202F16A13280EBC52587E616206E3AEF641E6A0294A7E574321A2CE41BAB9871A9E
Malicious:	false
Preview:	BM>.......6...(...7...7...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................M...F...A...X...=...2...:...`...X...]..B...+l..zj..Rg..[.....\|...y...v...}...q..v..z..{...j...f..o..n..j..w..e...[...Q...Z...G..T...y...p...f...;...5...%...,..8..........................u.M.t.E.g.<.Z.2.J.0.R.).>.!.2.'.;.5.2...$.............................'...U.A..~~..yy..{{..zz..ut..rr..uf..on..rr..tt..\|z..ml..gg..ff..n

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\OS.dat

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.373765379459472
Encrypted:	false
SSDEEP:	3:jBJUVVVFY31J+1jyf1J1AyF4ovf1Jwfvf1J1AyFzyf1JRiuo31JeFYnvf1JXvo90:jBJU/Vi33+xyf3BKyf3wHf3BByf3Va3L
MD5:	34C275EE1F7992EA61B44D72C8ED6DB5
SHA1:	24FEF4EAE09F8BC04F9AA8916538A0B05D520C61
SHA-256:	8819195120405611C3FCFF1FB1DB3AB0BA10370A5CAD6DA249158327B1A457D3
SHA-512:	FFCFF890C5419E9BBFA02984C28B1E01A6E5E9B38B23DE5C2FDBE8B11E37AFBD9DA7E8B4E525FD5B8D9EF42D48670C69DD63CC1628A7759857772DCB24AA1806
Malicious:	false
Preview:	Windows 2000 = 1..Windows XP = 1..Windows Server 2003 = 1..Windows Vista = 1..Windows Server 2008 = 1..Windows 7 = 1..Windows 8 = 1..Windows 10 = 1..Windows Server 2016 = 1..NoOSCheck = 0..

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\SC.dat

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.979018643483574
Encrypted:	false
SSDEEP:	12:zoKR7C7RUddIiXRQsthXWSS4s1XFPX/U0XtNmK1MkE/hkCqGmtEU:zoKR7aEe0bpWSShx/xtNH1MkE/hkCXgD
MD5:	0B21A5C4921A2785A5F2CCD2BF87078E
SHA1:	253C557996593926C5FD4C953AA332B82C1588BB
SHA-256:	2598290D1C4B8681A0372D9A3F43700D18181C1242A643FF316A8A1E32B293BF
SHA-512:	95FDE939C67BABD44AAB836B75EEF57483811A13A2F0BEE34DCCBFE94CB035767FE437785B22F3B444776CF22B82DAC737E9836DB253247D5E6A5DB3CFD5CD92
Malicious:	false
Preview:	[Setup]..Appname = Bot Master..Version = 5.8..Licence = 0..ChangeApplicationFolder = 1..ChangeStartMenuFolder = 0..Desktopicon = 1..Allow_Desktopicons = 1..Allow_StartMenuFolder = 1..label = 1..InstallDir = <programfiles>\<company>\<appname>\..StartMenuFolder = 0..Addition = 2..ProgramRun = <installpath>\BotMaster.exe..ProgramRunArguments = ..Languages = 1..ShortcutFolder = <company>\<appname>\..Uninstaller = 1..UninstallerFilename = Uninstall..Uninstaller_VW = 0..Website = ..serials = 0..Serialcheck = 0..SplashScreen = 0..SPS_Time = 2..Company = Bot Master..TotalSize = 14.1 MB..Website1 = ..SFA = 0..DFA = 0..

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\Setup.cab

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	Microsoft Cabinet archive data, many, 10508 bytes, 7 files, at 0x2c "SC.dat" "Desktop.dat", ID 12345, number 1, 2 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	10508
Entropy (8bit):	7.9591525913668395
Encrypted:	false
SSDEEP:	192:lQQNrFWwfoM349aGmRXEjP+wKL1S+wdWgO3LzPYuBUyero:/NAwfJYaGCukLM+wwgO3L0ENero
MD5:	546D45BBBC4F0A01C821ACA07CF3D386
SHA1:	2D31E127034D32A1AF45C3688F86EEE79152C0C2
SHA-256:	5E302CD6842EB6A17A1E6748ADAF886DEDA0FA5EAD37E0372FE22628F3758C6F
SHA-512:	ACB806869C789C07B9D558441BC89EAE205908EF305AF8F877D009BD8A876B66F8893239F7DEB4B51AB4ED4329A7E62AC3A7FE2327EBC98BE746A7B8C2B96D74
Malicious:	false
Preview:	MSCF.....)......,...............90..........i...............SC.dat.K...i...........Desktop.dat.................OS.dat.....q...........default.ifl.^.../...........Image_Left.jpg.>...............Image_Top.jpg.\|...............licence.rtf.N.A:M...CK.\.n.6...eD..V..{..v..M.n......l.l.N....@.K. ...H.'}.....Az......?.H....;m....3.D.....C.?.E........b..G....<...I.-...."..gP.../...&.h6&....g..4....q..U...h.'.'..p.>.f.....U..N...1...=.N...D,o.....q4e_..4.N...S./...Ex.O.Q......E8{..B..?mce..NN&)....9..%.}...q..g...x.:...H..`q.<.f)i=@.._.......\|...i.Hu...g.....C...U....~x...2:N&iD.D.I8M.#.c\|.._.i.....Q4.%.^.........V.....&?...~......z.]....\|../. ...\J.7.../...;w.0...?..C....pa ..a.O.]..\|./....w4.....x6...F..O>:..y.......1.SR...t:I..).O(.....N..'...4..@e_L.i....OU.^....4J...Y.6}...%...0.!h....8~.J....6~<.AkX...W-...+c....A..qt.~{A..!..g......J.....i...?..W.p...4.F........?a.>.......O.9.j^...,Q..l\|..]...w..\|..2..'...B./..K'3..=...L(.....ES0.......S_....{..F...i.O

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\default.ifl

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3006
Entropy (8bit):	4.906329518650122
Encrypted:	false
SSDEEP:	48:KSH5mNWUm8/7UzY8Dmwwn0VYNv7TO4L/kpLlpfX9+XD/Vyx2IBGG+KX2ihd8rdpF:bZhUP/7UURn55Tf/ipX9+XrVmRtX38
MD5:	DC51022CF78C9B519F2058983A773119
SHA1:	56BF6AAE50122301617CDAA7C5002C38FA1571A1
SHA-256:	93E28A5125B4864773F53D1C5F87C1756EFA0C2D60D5C3FD6B34AA920080F568
SHA-512:	DFAC8474BF7724B000A530B76152F75E146AE490D7F3D1F4960247226663EF738C88000A2B3C033BF626348DB4B33D7B26E0202B840052D80FF6C36BB8E089AA
Malicious:	false
Preview:	//(C) 2006 Forgesoft..//English language file for InstallForge.....[Main]..Title=<appname> Setup....[Gadgets]..NextBtn = Next >..CancelBtn = Cancel..BackBtn = < Back..FinishBtn = Finish..BrowseBtn = Browse.....AcceptOptn = I accept the agreement..DoNotAcceptOptn = I do not accept the agreement..CreateDesktopIconCbx = Create desktop icon..CreateStartMenuFolderCbx = Create start menu folder..LaunchProgramCbx = Launch..RebootCbx = Reboot computer now..DestinationFolderFR3 = Destination Folder..SelAppFolder=Select Application Folder:..SelStartMenuFolder=Select Start Menu Folder:....[Messages]..ExitSetupH = Exit Setup..ExitSetup = Do you want to abort the installation?..CouldNotExtractFileH = Error..CouldNotExtractFile = Could not extract file!....[Start]..Title = Welcome to the <appname> Setup Wizard..Text = This will install <appname> <appversion> on your computer. It is recommended that you close all other applications before continuing. Click Next to continue.....[LicenceAgreement]..Hea

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\icon.dat

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	MS Windows icon resource - 9 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	25214
Entropy (8bit):	5.835474441553232
Encrypted:	false
SSDEEP:	384:0dAfBqLXaIkeASzZ0oK78hUZZZgYa8IFDAcVraGFIdcTtwbMZ:0dawLXaIkjkqkhUZZZ3DIrd7RibM
MD5:	FA63A0160B9FF05DC70CFBCA82B465B6
SHA1:	0493E1DA3943D27A4A96071F914B9ED01E9C0DAA
SHA-256:	D3A14188ECCD7761CD20CE86237F481A4BCDDFFCD460871BD7B4504F6162D9DA
SHA-512:	496A7610857E77CB6CC6140D82DDCC975C6CFCF63FD3995D2C9A4B6ACCAF150CDB49686867A99EA1441B8D1C70224E95327C326979E22F11ED31838D92C6C699
Malicious:	false
Preview:	......00......h....... ......................(.......00.............. ......................h...^"..00.... ..%...'.. .... .....nM........ .h....^..(...0...`...........................................................................................................................ww.....................xx.wwp......www..............ww....x...w.......x.......ww.......w................~.......p..............x..................w....x.........p........""'xw...................""""z..................."""'z...........p......."""'............p......."'......................"g...................."x......................"x.....p..............*"x..................~....x......................x..................~....x.....p.x.............w..................~....w........................................~....w............p...........x...........p.....~.......................~.......................~......x.........p......~..n...................~.......w.......p.......~nnnnnnngx............

C:\Users\user\AppData\Local\Temp\IF{98A5518D-9C09-4147-BBFE-CE71AD0FBF52}\licence.rtf

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	124
Entropy (8bit):	4.834602545781737
Encrypted:	false
SSDEEP:	3:gOz4RJXDVWiFRcz7eVFMALMezbOGU5YB5DVALXA2n:L4VXFRcz6DqWR5JkQ2
MD5:	969D154352C0FAFB84B27B8CAF22D504
SHA1:	1E1C45A31C159DE7824332BBB95134663733F3BF
SHA-256:	CFEEE7E71A82187371519F9A0C232FACF5E82889C2E4AE7BB57532E09A5C30C0
SHA-512:	B38B5759DB705A0808F2A4BFC3135613607B78795A2D216ABDA06DAB0CE1BA8F7D56412B6B5319CB07066CE6E6BD181F940949CBBB99C27DB02C36A7807B6835
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fcharset0 MS Shell Dlg;}}..\viewkind4\uc1\pard\f0\fs17\par..}...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_euzn5ly4.z5f.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1pcuabh.00m.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qau2cjvt.dcj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qqxrkmyn.yyh.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qx4reff4.hur.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xu32ej2j.bqy.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2ztgzgg.0pg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjcg31qg.bmv.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\WinUpdate.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3511296
Entropy (8bit):	7.939995431573425
Encrypted:	false
SSDEEP:	49152:rbAa/I9L1n4OjdXalpe85gqWa4CRFaMQRh/7hK+OWp7W+qYp9foZWHyeHxYMp5FN:ga/K1Fa71qrMFO3DgCjqWQZWSmeMTPH
MD5:	F24A4D5B6036A3DE2EBA88868BD771F2
SHA1:	3048D822D2B80D66284D1446052DA0BA2BE27D9E
SHA-256:	2C2F38B6679224281D1F9A0BEE4AC5DB26F845E0D0EB74C0CAA2D994411EE7E2
SHA-512:	17A245A0C5E70982EA5F479319417864E122D3FEBBDF16D310D42B7F9ACB8D7135FDF9C34082CD42858A4B98E696EC02D17B69DEB249E8ED0CDFAB26EC909BFC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.e..................4...........4.. ....5...@.. ........................5......J6...`...................................4.K.....5.......................5...................................................... ............... ..H............text.....4.. ....4................. ..`.rsrc.........5.......4.............@..@.reloc........5.......5.............@..B..................4.....H........q.. I...............@1..........................................(....(............(b....0..E....... ........8........E............9...........]...8....... ....8......9.... ....~-...{....:....& ....8....8.... ....~-...{....:....& ....8.....(#..... ....~-...{....:....& ....8........E........0...8....s......(.... ....~-...{....:....& ....8.....I...& ....~-...{....9....& ....8........E........8......... ....8..... ....8...............l..7....&~..........~....*..0..

C:\Users\user\AppData\Local\WinUpdate.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\02c72bf6-4ea9-4e38-aeef-c6fa91f536d6.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\35d5fdd0-10d8-4a90-99dc-0d691dfb2833.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	5.452508354908
Encrypted:	false
SSDEEP:	48:YDEFMsFiHC0afq6UULIHgf5nVO3HB+5drxkB1ZH4cvRCTZBG/d2a:PNkC1fq6UU0HgRgBi+LZxJCTZI4a
MD5:	A65F112095FE004695CE8C8C2221B3AD
SHA1:	B1AF96629A5002BA08CD4E87CE1D8811E60D305D
SHA-256:	A7FEB69E0926A9FA54D7C022D48BA875B4EF247440F22CB71ABA7A544F9265AA
SHA-512:	CC1C362BCF554570593B3A918D1A7A449BA45B1AF72F94026295DA516DEB746ED133A771E8C356F6803ADCEFB9ABB780DAA7834BD5FC753020FDC6CED910E3B2
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"policy":{"last_statistics_update":"13354561863065213"},"profile":{"info_cache":{},"profile_counts_reported":"13354561863077847","profiles_order":[]},

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\3aea7d6f-1143-4950-ae16-e0ef76dc8dd1.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3436
Entropy (8bit):	5.266675819053177
Encrypted:	false
SSDEEP:	96:PNkGSCvfq6UU0Hg58rh/cIyURoDotomAB7oLZxJCTfX4u:PNBSh6UhHZVoDUO7Q6Z
MD5:	0232B9A667B6AFE5967B1919D5DE6E78
SHA1:	762EE231F32F5D20E13189F5F63F0B4805ADEB29
SHA-256:	A7147953E26D1D39D7131A7EE7FAA2B59C4210EFB08904806DED7F3C906C6111
SHA-512:	EDDC4FE8B740641B1937CDA11B20940F605C0EDDDABFF5DCC105BFC1CE31752CE37E1F23458230F9763CAF37C59BD97EB82465E0846BC7F91D0F1DF3AB152FD2
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.710088264565288e+12,"network":1.710088264e+12,"ticks":6381188236.0,"uncertainty":2649480.0}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85ex

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\4fcdd837-40f4-4c05-97b4-c98fe2cb88a5.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16796
Entropy (8bit):	6.070980111840177
Encrypted:	false
SSDEEP:	384:n8PofZScWax9YzUbCIhmbI34qS3sidzNBS3UhH6iEKWPESEryQ:erfax9YzUOIYbIofsid/hZEKfZ9
MD5:	154CE9C12F8AF4037188BD062890C496
SHA1:	0C0EBC22C7DC3F89588AFFD264B597156703D959
SHA-256:	97D6A92C7B368253E44800B4084F756604F06AF212C5EF898C8E21D6F8AF7EC0
SHA-512:	BEF484F1A82550A7376AB817A93877B8782BF5F9F38425837E8E30DF71DED73A742E9B88DC68D02DF7413B6B253165FB5336AD98D81182167E88C0962E4A60A8
Malicious:	false
Preview:	{"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUWzc2Oh+utHd+PXyO1Nb5/i/v/txI51Ttbz886+XfBi0Ejwoa/zln//7P99cDhYeKIm//XppeA+vXb6vG/nv7y6/uQzjgL8P3AXF9c9y0FzIXpoAf9twHfGP30GT8hdZ/V2Fq9cvb9nLNxd/+Pv3Hz/845sLrTp58TcpOvvHi3ets728ur1m1+zl65ffspvrFxf/4mvu1AMZdnt1A3+5vX3z8vK3bx7HM9E+HZGEVz/aTpr5MT0l/ov9pw2Pa/DYQv3s8ZP3cRRv3/6vTP7tW5j8q29fvWK3r47nPv355ub1NXv9+nj6/+djmvsCwFTvtIL+vlcm+PL3OHr3MMBfL70UK9GuIl/xuk6MVzlu4KfLv1nbaHkY2+VvwJ+f33Wytxug/+/LD0o46+06JJa5hLeil+6ON9DZnX1kd2ADbAF+98Dvl3+++e2bS765uRO2luJuLXmITt6JFtbjCdXRJjk8kPVd2isjNPzjEH6MuOa17bmCpi+NDGutdkzYPq3b+SQ+xFpZP1FmNuQj8WG5v9vcvMNJ/HWawzucwuGdoxmLuqfOzujx/W6wXv6k+fiz5PX4dNxeK9MUJvpI/Qv0uFFGPiUONrKwWULZ8x38LNlhtxKpeSUWD3nDkEIupdf8lqmwhHK3VkaFcWnHWx5EC6MXtsSXxSZUAwOQ0IazDTDV0mYq2Pgiug225Fu+ZYIvaaaVuMU28BcbnDVLRyMczMkB/4uWGyP10nZM4KFFllz6fex2cNKD0PKDjosXd9PuFm6pNuq4tFd4nX2KSnTwUYaljfxF+fY7M25b6WRZAM6KpIM0xEcuPXqisWY7PhA8PjkWlkk10MTl9/Dmh/X3ciOSTKaJjgKxAbUpAcQVF+aY/j

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\5b21276f-b251-4b0c-a62d-bc0d5bf0e0c5.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.254893091453008
Encrypted:	false
SSDEEP:	96:PNkGSCvfq6UU0Hg58rh/cIyURLl8DotozeB7oLZxJCiso4u:PNBSh6UhHZViDUP7QrJ
MD5:	1C435F64656BAFCA7CF9ACFFD9F8A673
SHA1:	03D2FE1F3C6F108C0DA7CAC271CFF9D2C79E1E0D
SHA-256:	AB8751924453C82D86D7C1FE670AC22BC543C2BF7B62F1110A4F658F38ABC5A0
SHA-512:	795C60F4CACCDA16ADC169DF1122DF985A7442C9A194461326864CE56C51B9FDE7CC0AEEF5C039C259CD91B5795B07B5018B27F6DA7E68C074973B6EFF4B18D4
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.710088264565288e+12,"network":1.710088264e+12,"ticks":6381188236.0,"uncertainty":2649480.0}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85ex

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\943fe13c-a0f3-4bd0-8bee-28fbc2fe60d8.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2899
Entropy (8bit):	5.287642189814302
Encrypted:	false
SSDEEP:	48:YDEFMsFiHGS0afq6UULIHg3p8QSh/cIgwLURMYXylVotoW/5K1DVO+HB+5drxkBz:PNkGS1fq6UU0Hg58rh/cI9URoDotoCuT
MD5:	7CE077916EBF6C87C6F70C124064FB13
SHA1:	541887E7FC8E5FFA6DBB290859F372245CAAE0FE
SHA-256:	E35BC5E107939008E9FC8753056813C3700C9057512B583FE8A2209DE22DA0D8
SHA-512:	423A1B5D368D82D3BD26468B937827ECDBC9520F1F537FE9FAE9EC1F633F52764B44D705E4ED646C1B3BE17E32B01ED7A95E783236885F462F61892F966D68E5
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"policy":{"last_statistics_update":"13354561863065213"},"profile":{"info_cache":{"Default":{"avatar_icon":"chrome://t

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\BrowserMetrics\BrowserMetrics-65EDE046-1B0C.pma

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.3830990029723777
Encrypted:	false
SSDEEP:	768:6YpM5CZCa+jdbG8F1ZY2zQ1b6zSCsxqQ2hqhnjNT5QYRGO:6fMZ5+hb1ZY2zQM+xqQ2hqJNVQYRG
MD5:	B9438C26BB74685BC7F0C12735CBDE97
SHA1:	6F78BED27366DCA0AC0ECE263503A42C47F7311D
SHA-256:	A0082260720F878B7502597D20EE9BE0EB22F81CA8D46B7A0637ABE20FE342A6
SHA-512:	9C6706CE762AE21BE1120E5572AEE18FDC0CAB011E468A06F0AB7F6E49BB92AA6AF3DD467D723E949F29406523B8CE10C6DD9676AF370F67D43D65AA04AF48A8
Malicious:	false
Preview:	...@............C.].....@................A..P1..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....;.........117.0.2045.47-64".en-GB...Windows NT..10.0.190452(..x86_64..?........".hravta20,1...x86_64J....?.^o..P......................>........iW:00000000000000000000000000000000000000000000!00000000000000000000000000000000000000000000!BotMaster.exe.!1900/01/01:00:00:00!BotMaster.exe".5.8.0.12...".*.:..............,..(.......EarlyProcessSingleton.......Default3.(..$.......msEdgeEDropUI.......triggered....8..4... ...msDelayLoadAuthenticationManager....triggered....<..8...#...msSleepingTabsShorterTimeoutDefault.....triggered....8..4... ...msEdgeMouseGestureDefaultEnabled....triggered....8..4.......msEdgeShowHomeButtonByDefault.......triggered....<..8...$...msConsumerIEModeToolbarButto

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\BrowserMetrics\BrowserMetrics-65EDE054-1214.pma

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.5656913131517847
Encrypted:	false
SSDEEP:	1536:hghx4UeXVG0BYRt69jGJ2SR1RGg1DRFFKRGQFbLfqDac1WRG:2feX0vRtuO2SRKg1HFDsLfqf/
MD5:	6E409DC424094214D0997E3BB10EA344
SHA1:	F87ED1D160CE677FB3A445C956E36C5CB9EBBE09
SHA-256:	7551EF627AC42108705A0B426E843762B312ECCD44D612DD1012ABD3D6BFEC6F
SHA-512:	8524500340328C6F98E6B007E7681CB171574ADA36F8804A93E38EDB498F69C8EEC51F699AC4FDBA51A02EADF8AA7FAC718876D7B4D68C68EE3469958760B206
Malicious:	false
Preview:	...@............C.].....@................:...:..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....;.........117.0.2045.47-64".en-GB...Windows NT..10.0.190452(..x86_64..?........".hravta20,1...x86_64J....?.^o..P......................>........iW:00000000000000000000000000000000000000000000!00000000000000000000000000000000000000000000!BotMaster.exe.!1900/01/01:00:00:00!BotMaster.exe".5.8.0.12...".*.:..............,..(.......EarlyProcessSingleton.......Default3.(..$.......msEdgeEDropUI.......triggered....8..4... ...msDelayLoadAuthenticationManager....triggered....<..8...#...msSleepingTabsShorterTimeoutDefault.....triggered....8..4... ...msEdgeMouseGestureDefaultEnabled....triggered....8..4.......msEdgeShowHomeButtonByDefault.......triggered....<..8...$...msConsumerIEModeToolbarButto

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	modified
Size (bytes):	280
Entropy (8bit):	1.8931011582971837
Encrypted:	false
SSDEEP:	3:FiWWltlOfVtJ/l/NEjYb1gmlw:o1OfHJ/1fCmlw
MD5:	9D1325903D3C91A3EE112737DCD4ADC4
SHA1:	7C356E9DBE2921520BD0EDCA4D9E02E7D4E63EEE
SHA-256:	8F17D6F609B9F6647E49D372F77D0308A5496A369AF67BCE6AC355AD7E421692
SHA-512:	DC7F93D7F8732231BA747CEAB3D7337F417868B0C4CEA3915AF39C619D067AC556A8776AF4974228FE9D8FE6E472202CAD6D28F7AEF7CB0DE5B441C07667EFC2
Malicious:	false
Preview:	sdPC....................C...M.:F..$S.H.O................................................................................................................................................................................................{F3017226-FE2A-4295-8BDF-00C3A9A7E4C.}C:........

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad\throttle_store.dat

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\4b931405-217b-4ab8-b1c0-9a5a3f414f2a.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5604
Entropy (8bit):	4.754422429722215
Encrypted:	false
SSDEEP:	96:stK/vL21s13UCa8zodY5eh6Cb7/x+6MhmuecmAeF9eIMR7K:styvksyCak+Y8bV+FiA4edhK
MD5:	6AAFD5AF934E4EFA8582F8CA35D166F8
SHA1:	835835ED12C40D04B23BCF72734E88766AE8A955
SHA-256:	11ED3989B8EF8E510CFEAC18F35CEC627B5F239EDC4E4C17F82FC20A31C0D57C
SHA-512:	310E043B27338FDB023038466A5890033550593AA81DAA9642EE402ECBE3EDFC72B71646FBEA1FB0C7A893FB40934B730B26317BB418291CDA1B908ED6224F9D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sit

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\4bc71ffe-b762-4ed2-9476-e8db1fd81368.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6277
Entropy (8bit):	4.832468161832733
Encrypted:	false
SSDEEP:	96:stg/P21s13Qb9JrG8z285eh6Cb7/x+6Mhmuecdd1eAeF4X2MR7K:stU4smrGk288bV+FJdQAvXPhK
MD5:	05E9B3294C14EF0FB37CBE251C566F63
SHA1:	09F403B864E36848200F340FC83BCE107D78FA72
SHA-256:	2C35223BE24B24AFFAA001316A1F946E6B8BCEF71F2B5A3D8562648BD8A0BFCF
SHA-512:	7470C3B677CC45B8A9668104985B0E0B5694FB051CC99295A922E0F6C874215FFEC70F909CFC26FE505CC70BAE293A5952363453F31B2364B01ED61D44DD6898
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":576,"browser_content_container_width":1049,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data"

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\8640cee9-57ac-409f-9e24-9d6344030e08.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.579760184607159
Encrypted:	false
SSDEEP:	96:vkiAPlf/ROoBpkF5d1OiD7VaTEv9V5h5pg5vezodIU8PmSpsA5IOrMn3YPo0MG6q:NkrKF9l5PmSpFIOAn3go0iuN
MD5:	14B5DCE22494648DD6683EEDD5E5A1C5
SHA1:	FE7926A2E4AE31A534FAA75AADC9DF7D73B3B000
SHA-256:	9F76ED2DE31BAC2BF600F450DA85554D446DD316154E15619F94B32A2E9437DD
SHA-512:	90592B3C8C8E8F47C5EC204F60D379DB0D248F383A39A3F37344653FF47CB8FFAB5F790C2221B6F0D71BA4F86B2D241373AEDBDAF6470536ACD77571CF3AC538
Malicious:	false
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354561863316208","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354561863316208","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\987efa7b-0e01-446a-b104-2e597825b01a.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6339
Entropy (8bit):	4.837064587129478
Encrypted:	false
SSDEEP:	96:stg/P21s13Qb9JrG8z285eh6Cb7/x+6Mhmuecdd1eAeFCX2MR7K:stU4smrGk288bV+FJdQABXPhK
MD5:	70754EC013109D64CD30D3738C759E76
SHA1:	80D4C667F8AD728A42E2F1920405CB25973F80C7
SHA-256:	0A7BA5E94A7A1B1F6ADA5817AFFCE21DF001C56F883F6777D956DB53534EC6D9
SHA-512:	4298BC8355DD8019DD8302B817CD33EA0BBAB1B48B389ABE02F6A08316236765C53C8F51E0127814EDCC2536D3D55D190AB9F5F03498A137A8B8DA15C20F8647
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":576,"browser_content_container_width":1049,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data"

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.15542643195233505
Encrypted:	false
SSDEEP:	24:d1Ipj3KZ9CoziRWK3D8objEdyQCfKuUVFRZWsXTBw0u:3IwjCoe3LrKFF3WMTBwl
MD5:	E996C7F9063D4877D7D47ED59D214E3F
SHA1:	D32062E40E801DC37C788301881BDF18AA5F214F
SHA-256:	5BEA1CFFA19EF1122135AB5B8A425AE8D7D7EE9F969B37AC2B80A522CCE1EB66
SHA-512:	D559D4E264B5F9454C6242D92C68B2B59B717FC1AEE771DF6F25EB38C0546694B8868AF640AEC1C31FE3B108622567FC252FC2F0610DCA782E8006710BF3AE27
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.2938196478181513
Encrypted:	false
SSDEEP:	96:gS2izTnQMgbIkV5XB7hMw6Td4lK5yteyOw6Td4lK53FT:gSfHnQ7bV5XB7hh6J4lZeyv6J4lkF
MD5:	8AE23F4016E5BA2D56A380E8DEFA60E3
SHA1:	03C756E5C117BF189DB4D757A14D58D162564AA1
SHA-256:	D54DFA83F58405EA3EDE4AB6BC10F62BECB8E577C1756B20F9890B086E15CA3E
SHA-512:	CF6FE19DB3E394A670C81CB4E0E783A162935C5E6114F1164B099CB47836BF53850043C67C18FBFBFDC6137B8DDB8FCDF87EF3AB65E4244A73D4EF25CF69C84C
Malicious:	false
Preview:	....................................................................................?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.5916252342007957
Encrypted:	false
SSDEEP:	1536:tHwGe9wGI5tvMv9Hwkl9SBwG8rkwGFTVHPjAxwGDahwG7OLSJ2wGwe2wGX/dwGSb:tuGIxSWyvsgwAOa3mYXTtUjDZ64+zja
MD5:	DEDECCB63FA966943408567D09F0ECEE
SHA1:	D2386CF47D31533AFBB71AC4FA715E794F2A4257
SHA-256:	51F856583FAA4298564ABD3AC6DA09F1BC361EB59E775DF2AA0A73D3A420880E
SHA-512:	B3D2E22F59909ADCD2010E46E85ACB6C574FF37DB6D60D972C19D60DB55D751F4D7CB66B11FD7A0A266F887022EF988405E3182E6A85B0709795C00098628B0A
Malicious:	false
Preview:	......................................................................................7.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	61600
Entropy (8bit):	7.99601906843387
Encrypted:	true
SSDEEP:	1536:qgtYqAbU4UegMLbhTJC1ouyk2vjfF+Fm/qmYf3bcH:73CU4UwLbhtRjfMldf3YH
MD5:	2DF5F5D6BBAD66BD891AE8B7DAD3E247
SHA1:	5CA7598386AB089F6BE3C461215F1B42778742BC
SHA-256:	B94E0DEFC6031F32A9A72EE336A06373B916FD4D87AEDB586FBC588F4D1F13CD
SHA-512:	1F287F7CDFB0CEC556737AC8DC343ED5F775AFFD190C9F96168C825BF12FBFF33659A901E831583828533B1F30C360CAA8912BBE60F3378A1BF62949D7A75513
Malicious:	false
Preview:	'..1#]..\|.$...o.9.......7..?..[`0.~.0-..t.=^.....}.'...1 ...7zs]Z... @4$1..ZL.$_.=.l)c..!.`P.- .O.U....\|!.R.."R...6.5.[..`..4.. ......?.....:Sn...u.)....bI....igQZ....a...M3..Ni... [?.!....{.{`F3@R..l.....~.}..M.n..u....;....j?<>rj.f!t. .....a..e$0.$.,..P.h.OO......{.^!.......C0........g...F(4"B.....5...d.&.%(.3=......4...X..M.w.E!....4..p.....}y...(.:HjX..3. Z.<.....\..].dW ..?.5...=.WB.[V.0~0..+rU....(........[b...U.6dZ.5.2....z.?.f.vg.4....i....?..1..;Y....6L=..s.c.B?IV..-..e.?.8....b\2........8V..!.m.w....W.6.-.L..E~Zm:7..,.O2.,.Or.......l.O..J..;[C.... ..y.c..ev....""...i.z..i......X..}.P.smHcS...V8..VH"qE...l.0. {KaD..P....Eg..R"a..C.P.zF..%......$......z....W..UA.I.......bO..7.L..=...I.Tx...!......G..-.S8......yt...)..vu[N...v.?K....RDX\|..gv.].U..!y..._).iw...X.x.Rp.3T..C.....!..?..g.z1..px....E@'..v.Gg...0..am..<:.....c......=.......a..1..t...x+.#.c......W..f\|.).E cH.m:z...,v...Q4...[..2... L.(.q>(.....<....?.+.4.!.....B.x..~.czz-6ZP..%

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000002

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with very long lines (937)
Category:	dropped
Size (bytes):	229174
Entropy (8bit):	5.307942378379161
Encrypted:	false
SSDEEP:	3072:9JA6XHyQtP4bAbamDp5+5YdWLgZJSVY6zrTC:gOlGmNtPZJutC
MD5:	FFB363554756B67ED2F5BF2975CCEAAA
SHA1:	0C7B9920DD6E69BD1702285CE47264AA30D7CADE
SHA-256:	7D183954F519B0DAF8AC76850BE426D71CB8AFEA4C61B013FA0285E1B765DFFB
SHA-512:	B3E2FE7EADB07516B591F623F4DF23E52111BA3D60DDA72D77016DCC7D4CD6E73976657DD93DAD00DE22F9C4A9E048465D8E1D59110CB8A2BCDB95ED73FAE458
Malicious:	false
Preview:	.a1m9qzja{flex:1}..aja0x350{text-decoration:none}..ajuzgosp{transform:translateX(50%)}..amxrrayi{transform:scale(.97)}..aolan8vx{transform:scale(.94)}..b4a78re4{transform:rotate(135deg)}..b4xm8rjh{transform:scale(1)}..b5bqnu92{transform:translateY(-240%)}..b5u0g8pm{transform:scaleY(-1)}..bglikw2g{transform:scale(.01)}..bj62907l{transition:none}..bnt9nn9b{transform:translate(5px)}..bpg350cc{transform:scale(.95)}..bqte3on1{transform:translateX(-1px)}..bwjm0vhl{transform:rotate(-90deg)}..bx5xyesa{transform:translate(0,2px)}..bxpi4b5r{transform:translate3d(0,0,0)}..byw3xhqn{transition:opacity .3s var(--t-ease),transform .3s var(--t-ease)}..c5h0bzs2{transition:opacity .08s linear}..cgi16xlc{transform:translateZ(0)}..cj60lzza{transform:translate(0,-3px) scale(.65)}..cljgexa3{transform:translateY(6px)}..csshhazd{transition:opacity .15s ease-out}..cxnvdhix{transform:translateX(1px)}..d4g41f7d{transition:opacity .2s ease-in-out}..d7dzraxg{transform:translateX(2px)}..d9ddx5tg{background:linear-g

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000003

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	89210
Entropy (8bit):	7.994540197500218
Encrypted:	true
SSDEEP:	1536:wSS6O4O20i8So+VO/JZARplDqBkTindDacGl5LV+TT/4xOLTQsQcmpYb:wGL103GI/3he+dDaPz8TYOLTQsQcm2b
MD5:	2CB586BDDEB49540EB56C0F7AF4725DC
SHA1:	622D5D204E4BD8F68FA60E6AF2E558C416761304
SHA-256:	05991008258FECDA54EF330866E2765D5A56F6D8460F7A3E84D25C4AC2A261D7
SHA-512:	95ACDD08EF6A6113EE2C0A0CDBF5A66B478592404A997376F5908227D7C379C2EDE9B8CE2B4364BFFBD1865024748AD8D15C7C26F22DF69232E9C17CAEAEE870
Malicious:	false
Preview:	'8.QE`...@.<.Q].aN.p9i...j..w..~...?....`...aZ..r{.>..}[.......o....y....70.(......6.......C.............s.Q.k.H?.q..........(B!.......??_.k&........=.D.'....=Y..."(..&^..V...%.nXh....E.$..qnT...}y=S..R....l...u......f.bnu.%.h1...4n.R m.....Z.b.xG.....{3-.iWE.......s...!O.x:o.\.{.w.....g&.=@..2...t.....rw{......2 .p..=......U...g}..8.^)..EW..PI. ..D........\|.....g...cn.L..A.......j.......n....u7 m.H..8.AP3E..Yj.."..Fk(...n......].&J j.......o..0...i..p.C..(".;v6.....RD@.Q......* ..9.e:..oGJ(......HU;.6.W.I...1....}k.........M..W.......P3..6...B....1,m../g..Q..tY...t....l!41i.C.._...k.c,...(7..7..r.\..'Z.\S%.H..O.g...6Eh6...O..'.=..p......U.~R;/b....[.>..g....YD.\.U\+..k .I......8S.....X.A:q......)..{ru....).w..........G.@.>4.....1p.B.. .BZW..j.8.....y......%..L.I:.5...x..D.oZ..\]h.!...S.....4>...&n.....H.0d#...]x.!.14..E.It.D...y\..4fQ..e.d..z.w...:0.\|y.....e.Z....}.7...w....g[..4.].f.......3.;.......i YtuM.z..,.......{s........z.......:.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000004

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	233729
Entropy (8bit):	7.998615456017633
Encrypted:	true
SSDEEP:	6144:4gauD7UV2a/nRMUASuVRS3J4rkt7N/8+8UVt6lSal9kfPu:rauDoV7/ZnuVx4t7t8oKBP9
MD5:	25CE27EC3B2E674CB3538668466A0887
SHA1:	ED63C70583F774BD050DB6C43C6036194791C715
SHA-256:	952D42F0D09686F9F00345F34F3EA21709AFFB4589D69985C5FD9793B6974E5B
SHA-512:	F52C7F177DDA6D908C9CF7DFB775E11886C70AEBC70FF99B1F20989BC25CDD615D3A3CF95D613D3BC7271C809D1CB1DA0437AB362E0ECA449C6BB80D9F5F3711
Malicious:	false
Preview:	'Wv.B...@0=.....!....g<...H..q.....@UUUUMI.x......O~.._..w..._............??p.p.....C#c.S3s.K+k.[;{.G'g.W7w.O/o._?......."SY..^.=]..~..L....0A.p..:6c......K..{%+zGe...N{..._28..zB...1.@...p.eP.......=..5...x.m.l2y.&o.gJ....K...ql...j.......b.G-Z..8!..u.H<.keg2..G..M.1.h.........?_p.......!.i.@......a_c.Kr%.Gb....y..j...U65E $L..b..+.l?@.#.I.]........u.....w...%.#G.'..E....r..N...w~....%...).q.Ay.V.S.W...7..{..r.n...H..9-.,.Q.#.a.@(.h.m....R...)y...wyc.....N....>...7....m5..6...J.0f.2..J].l....e..?_ij..b.....v..H.[.$C..+&q.`O....v.......OxH..i.D.k.d..$'YO.W5..7..j.d....HcB.g.'`".X+ge;...f...3x...._.......b(g'.a%N<.8.3^.it\|a...S..hz.....}}..N=F...esn8.$.Lg....5..C.....G.$........./...Hq....(..<.3.$....x......hI........._..G...f.e'.....U(...+..!l9QQ. .4......~.s\..$..t..../.kE..[ ..j.Fx....;.L..'.K...V..}.5.}Z..t.+....Xn..K)(.a...X:`...@.h...a,A!.....2...C\|!.Y2.F....bk.p .......s...'...\|....f...;00s......=3...4..4w ............../a..Z...V.A...,.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000005

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1554266
Entropy (8bit):	7.999317969130873
Encrypted:	true
SSDEEP:	24576:hZuFTO1+gYizKWjAcwE66dXrXlmgimNfSIhkLSiuvoL+BAGO3H327mQqtNBXxaAL:TE6+MNDXgzmNfSckGbvoL+1O3X2itNl7
MD5:	8002EDB3DB5715A9A7B96835088417A3
SHA1:	4A6195CF04DE05A329BF77BF02FC9B869C450673
SHA-256:	83A969883277C088A063E780EAAE44BCAB2EF081DA9116945F84CF124BF9E376
SHA-512:	1BA7BD6C81455375C697A9DFDF3FD3EAA4E17583ACAD3EF5C911389C51C8B86BE1477A9EE50BC9E3E9E6AD37A60826826C2D547A11F695815D28FCF364507A96
Malicious:	false
Preview:	....kP.}...D..L...{.<T6.aT.....=ls.....@.<............p.........?.#?..?.3?....+.....;.....'.....7.........o....O.........9 ..l.2.C#c.S3f..`.e+V.Y.a.m;v..w..c'N.9w..k7n....g/^.y...o?~.....:..?_.]"Q...>t..,.?bjE.B.Y..._E..J.0v.J..C).....m...g.9Qq....4.}..R..~...H.'.....Iww.....!.Z"R!..!W.W.....{.3K...ip..<7....x...R.R#..5.0.l......._.7U)j.........".Q.JD..tq..fk.X...\|~.O..~Rf.'..)u....[Xt.X...ba=,\.....w..cm.-..f...n.\..2.D.T..T....!x..aM-..oA.Lq...{t.lG"..VxE.y...eZ..vC ..T.J.-f........(KQ.e.)..\|P%..}5....5.....y.....h..LyE:.f.gN.Q *jT!..Q...j..../....[c2..\.m.l.b[r$9.,.....r...<..%......._..J&.$.(...2.}..X.W..3...X.).._..W....;v...8R.#..t..`..T..WE'....<A.v...m..b9..\I.!@..b.z.2..r.y....R.Z!.W.......x..<.Yo..Yf......1^k...H7-.{=.E"31E..$X.<.z..c.Zf.....I^.f...d. -.F@..K..}.j..w.\|T......s.......!@;_.?....P9.4....c0+(..Yjx$@...a7...<R;.....7.Zm....[.=..N....~Y...FM.......j..hJs....-.?.R.}.[N...R.j=.."7%....6.d..o...].?.._.r.{......Q

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000006

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	17785
Entropy (8bit):	7.985389016638041
Encrypted:	false
SSDEEP:	384:TqKN3pXVb+FeRK2usSzjSDvJOh5i2B0IZxpfKA:TqKN3aFMKuu6vJOvPB0IZxF
MD5:	F5AD1F305492CC14C7B1B6D1E67486AB
SHA1:	51307AB68D8DAED448955AC33349FC1CAB62A3DB
SHA-256:	A1A2DAF2DCBA044B242FE4DB44526A00AB62E3746C2AD1B58947033850DCD364
SHA-512:	AC7042F1026888AA2EE7B03BBEA6FFEF7DFE8050C148667BAEA17E6ABF6F206778C02869052563C602F7CDF45566F4ECAFAFFC6500860FBBEACCF23BCA3391A0
Malicious:	false
Preview:	'..Q$..z("I.....I=.............20v.......nY.."T3y..ao.#&,\|vIXy...3gcv.]yEs.T..}.{....y.O.!......AN..,9..g...J.~.........;).$3.....^...9....$....$ DP...>...t.....j..........M....."/z.((Y. ~3S.).,.e.G?$.........A{P..._.:\|...dg.x..M$D.....:WN.........oSWIG.%(..,4.1..C........U...g....P.#p..%2.Rtt...L...8[.W..!.a.h.S!$...w.._.;..Y....e%.A9...K3....u..... .._...9....[~.g.T..$...Q.....)i............Q.M6..g.....4.....]....~..DV.............'....9f.....P@k.w6"D.....6.b.V.......,.K:U...b....6+...#..7r.........;.T".X......~.W.....!.[.}w........\L.%....."W..E..s.^&.....(M.#rUR...w.)H.-{.f6.OLe-.X.....Gm.<....8.......X,.A...1M.&s......0.bze.....V.l..V.sh..z2.h.lM....&./@[.P...A...4.......#^.cT.......}....m.s...R..Q.'.K.._..AF.R..@).........j.z[[S..A$.O...(D..kq.cB^UB.Sj.6...b<l(.*-....U.zRW..$.dJ.%./V...^7.\|...]/....A.0.u.....W.<........2.=.U....!.c....=[X..f..OC...d...KS.qL<..%.XRI`l..8w..r.......4Y..N6+..\gs}Su..h[uk[S.1._.F.<./..."..m.u..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000007

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	61005
Entropy (8bit):	7.995327831326715
Encrypted:	true
SSDEEP:	768:+aAZ9EU8GJsCETSpWtVsCp+CbmCm7CmVh958GzQSpaDGR0X1SkHyAr8U5E98AfY7:+amGrMrASmVsc+CJIh954So6W4meqA/0
MD5:	B01468F7E6C62324751BAC6A73557EF2
SHA1:	53CCE74DED414D63A37818B3E93C90EF2711FC7D
SHA-256:	6B8B6C775D4EE1883370F12573E9CBDC84C0E10BFCDD84C2D5A043E606035720
SHA-512:	28CB21A4CFF2FB1905191A0A8CB6FD45511DC2AF36D7B7BE316EE63155BF76B38E1105DDE5D82C0ECC2C0B92C1F7CBDCDE0C1562C7505E8E7D566F4F77A60F50
Malicious:	false
Preview:	'...E.q....?......=..).........l..x}~.....~;...B.M^B...../KK..s{....!43.\...#...I,..3...om..m.....7..3...$..~...W.F.-.q=..$aKB..d.ay.}.Jj..U. D.9...D...(...M.k]D;F...q!...5...q.17....L..@P. (.......s.}U\|.U.....H.. ./H...)....X.T@..R..^k.....U.:.Z....u.5...B.y...>.K...J.w.C......^...8.!....5.\w..u.e,.."}............!.!0z."...........,-/..R..D+b......7.{......a..H....g...s..<....5..Z...%.`....ct...nI..m.1W<.........]_V.M..a..J..~..nL.D..6...U..-{v.\'...?H.m....FUO...<..T.j.Y...j5.@..&y.......d...,..iV.......0......Nt.#.....]...#2.......S.q...'3`C"..r..........r..`zzz.3..U..1....9.T..c_$...44w..5z.......N3..Y)/.Q.fu%.^...P..j..Z.QsH7@.o.4ha..i..%"....\.....)..rid....B...=q..L7r.g..t#GR%{....W......C..D...j...R.y.tf)$.ck..6....QQ...d.!..6..g..(..IG6Yr....L...y..1.....8.#.DD......Z.>.....U6...R".N.t\|...Y.v.H..5...N..V.%O...dZ...B..8.1...C.X<..{~..e..qFD!Y,.....AM.......<.\..D.i~.C..u.yO.d.X..oX...,....H........8M.'....N.x;"...o.^.~.bD.....X

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000008

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	30388
Entropy (8bit):	7.9913078115727885
Encrypted:	true
SSDEEP:	768:PzZ2a9GmPYLF91/ALp9heZnh67n57NbuCBbteXU:PzZ2aQWYpLAIePneE
MD5:	A911176632F31D16659CCE7C8F96C60F
SHA1:	42E26BC9ADD2A7295FC386C81391CCA02D5D6271
SHA-256:	A0D820956479E103A382E40DCA56FEFCC8342B4351D0AC5985408006AAE98DC8
SHA-512:	F5AB7DF910AC90145C186FD301C490EE1B5C16721AD193EB5AAF9280DA6CC89E76BEAC980116EF8DD8DE31687119BCFF602253683A485A16AA6E1A385F32C5BA
Malicious:	false
Preview:	. %..d...@3p\.u.-..o_....J:...{..IO.*.Xy:...@b.... Z...f.....Z.e{..I`%..>2...17...ZC.....@".H$.r..s....=.$.."......0,6a.H...k...8.$.d..q6.5Q.=Y..o..[+ADDx.KM.....6.....c..........._3...7Q.....].ea.d..........8]._......]....A......v.i..Z[Jm.]BUhkQ..)\|....}AN.........R.-WF..\......b..T+....n....M.\y...D^..5..>..I...K.P.<M.D.%...k..y!.......r...su.....z...n...=..).6...E.&.n.5<.].~^.?.b...).;....c..[.^...q.'..B.n!.P...~.....7.yr..E..o....T...O.L.@51.....J.r..R.cANV.#...Qt...=.....h&...95...^UT...b.<........g...;.R.{q.....Vi.z.z7...H..j..S)...}.............].0.i. (............3....P ..zg..D.-H........m._..r#.>M..........^...%.....J.....2..B..ifVjH.....L.lF..Z./.f...!.x.VtJ..Gd.sp...$+...-:\{..........&..4..Z~9...... .+...7 .k.q\|.F.}.....(...Jnu9W.8..@Y.j.O........`E.?4.P.%.}..`...h.1..&.mM..X...(.....g5~p.99...2.k....o.....1......q..%....P..9.-..o.9v...C....A...e....(E6.t...U.....W.y%\.ko+Z.h.Q./...T...?26.p_../..... .}...2X.3./h....N!._?.q.<p..H..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_000009

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	41677
Entropy (8bit):	7.993642166859117
Encrypted:	true
SSDEEP:	768:xvtsoEV4kasEB83Dy1Ev4rEVhpuVogM5KQ3bafr9mO7Ua0XhN:xvHPka3BoD/v4AVh6nMcQ3k5ihN
MD5:	32C059D92C6C9DCEB08FA6F8815F5743
SHA1:	B6AB9CB8D5036627296C6FB4550B026F94C45B71
SHA-256:	6F69E05D88EC9CC620AACA8E6968532D027753D638250D6AA50D89783A9259C2
SHA-512:	3AF5E7388295E4FE5BC2FF81A8C25015C406924B7F764D8A21BDAD8580B833621E88178BA3AAB8429934BFA61BDA5989DCF19B59C03514F6F0835A08C981F4F1
Malicious:	false
Preview:	....QY.!....V.....h.,.............t.U;......p$~$.B\|...}...f....8...A`.N.DJ.`\..tE..T....Kg.u.g>.A.6h....F7..!....$@....!..P.3w>...K..2W....H2..K...^.]..{'...iv.9v...w~...,sv..Y@n@...eRdl..q....+-.F.m48m9Z..'.=.'.{_.."...@e.#..Z.UF..Y./.ga"....E.).j).cTS...p6o....G..=.6S..........c....^~..FD.!3.Z....Y5..X.1.F._.....8lI.W..].}F<.Ju\.B..&.2.0.+....2.F......>..{.y..c.{...{..^..}.<....z?.......~.+.y).m..f..S.;`.._~.w..w/t.....<.w......^.{.vn"..x.b.Ky..?.?.R......z.L.Xgx.Ky..>r.]..97Uy.M..9.....M....$hF..N<2..@8R...y-..%.z...x.yj...W1'f..*o.I.8....C..)N......e1E........2...p.#..3../._...Y....}..c.{...{.9;..l..1.....c...S......V.j..)Os.a.r.'.bL..O.1.U..\VNG.vfU`.....,me0.y.5.-;}......\..5..S..A...M:......vl.UlE...X0Oeh....]...w.\|.....U.;.B.....5.37.{.$./.N.....98.8.C......<..M.O.1.}8i.G<u....O.Vqy.,G'...4!.=.6.;k..._...t.Xqb..l.0...G.'.G1(2...rc......L.@..(..J....isIF...~.....d.@..$zb...C...=.B...zT.%$...H>.......r...R.@..6`..h.K...\

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_00000a

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1235163
Entropy (8bit):	7.998934966193857
Encrypted:	true
SSDEEP:	24576:Zri/YuWnUKtL8SfdCGi2/bKaJMUZs/587q84mfcNqcnMCsfFMeDyKp1:tgYuWUiAcbi2TTJMUWK4fAcWMeGKr
MD5:	45BFA234D28D947D096418C00478E7BD
SHA1:	8BDD2DE84B6375D0FDE0C56FC3D96A476ADD92F6
SHA-256:	F0F4C29BDD4AD238DFF8431C9D885954EE5D1EF33255A6B2A9A2088874EBE2C9
SHA-512:	C0AD155F775CDE9406B78073145C526EF550558BB06A930EB21B4ADDC87404ED32460D056E6889B1E348F66E0D60CE03F3F0DB4777D9643FC9DFF47A3271FF2B
Malicious:	false
Preview:	....GT/..?l...\|..Z..6......[Q......l......PUU....j?.._~.?../......k@....!0426153...b.u.6m.c.}...9v..s..].v..{..=y...w.>}.........v..Vf!m.Y(......}..qh..L...vOL.......7x^...S.....-.!t...+U..D.[r..@...V......N..t.h(.+..\c;..^A.EJfB.l.r.........9_h.W.J.v...(.......S....x...a.KK+_..`B...V....V..o...7.R..p..H.O...r...)INN.KG..M.1...P."....0..`.y.f]...5...\|..BsU...D......y5v.._.WA.F.HT.v\...U..m.f...\|....JD..,.JVnnpj.$....,'}.~...>..Z.X.X=.P..x..s....A.oZ.}....R..@\.Fa.8N...]K.t...Zbl..Z..6...Z...)....n.<..G_.#.KU....rW;^j..$a.....e.Y.g.2..d........_.._H..,..<9^..mK.i.4..=.......{..f..=.v7).aO.Hv2aV.![J.$...&..3..[m-.z.@r...$Q..Q.%q.U...t\|\.y)."...e.....=..y..^w.v.....i*.~..F....o@dgL.......ta..kt.:G_^_..:.{./..{ .......gwe.s:..s....../+.%..,.<.,...._~..W=b.(.1.........QD....w.j5.........$..U.~U..mi5cM...6$4..5....L...r.6@U..~.Sj..e_....P.f.BC..~i..Of2..U...S.=.T=Lv......U.I...l.}.{.........+"....g..'n.... ....."S..L.@..@..S...H.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_00000b

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	892869
Entropy (8bit):	7.999291051889471
Encrypted:	true
SSDEEP:	24576:szGr96V0PV8xn+W/Em9kUiRW3ecCm62qnLdxwPGi:seyn+T07VkmWnLdWGi
MD5:	BE1C26937EF0799A78B99360FBE6F8DC
SHA1:	6C5F77BC9626B1D592617EB38356CB0A40ED3DD5
SHA-256:	8B84587913E442B451C1D3AF6B1BDFDED7BC922A998789874CA266A1E83E812E
SHA-512:	C245109CE88934E2F3BCEAE730C80EBBACE776F884CB7B7C05516870667E354107ECBC50885A02E4F41F1C3565F53DF619970B93452248FCD401AD5BF63A3D01
Malicious:	false
Preview:	........Q.. ..........yxB....M..x......................J....WUUUU................_.._........?..?..................................................ML..-,..ml......9w..k7n....g/^.y...o?~.........j......$...NqB.)...H..j@......_..........t1g$`^I..UtL.&..5...!}S.v....tq.].L%l..olB.Y!..........C....\|....K..d..J.$?S{....V#2...<.pL.....{....S.......v..=Ig..&....p.5..#.w:...}g...h.z..`....y..@Y..v..,.$j.)......../...z:..!..)}....x.\|..@t1#DHb..\|_.._........zZ......v+...p@...S K.r.C........eu.,...HHtM.......3..7:..2.d...k...u.(.h...jT..@.1.M......`....`B.~......P.Q#u...r`3.C.;s..6.;.w,.............5U-!..:Mf.JB...&.R1..sc.....r.K3..7....Q.i.vf...D9f..%h..VqC....d#..m......T3.Q..L.9Nr..s..r......C.Z.k.kY..u9=...4..eKN...x...#UEI.]"...............+%'..}..M;`.....N....p.M..H..........+r..AE.05...^......vl.#..hAdQ.4T..bw+"...Y...;.q..av##.pt.I.,.B.<..qC.h..F..B..?.1._.\...7.3s.....`..0..X.>..=....~..(.~Q6...?.W.....Eq.Y.p.&..eR...+.n.;.......$......("..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\f_00000c

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	307110
Entropy (8bit):	7.998346865766936
Encrypted:	true
SSDEEP:	6144:IYFBHOlcf0q70z2Yn5Q5DFgDeoT65LBzHmOxr88iQ:IYFBuqMq70z2jxY6XmOxr7
MD5:	C3596B9D76447863A6D090063BF6900E
SHA1:	439B20C688ECE7888DC692B2AE1299D2C83A6C5F
SHA-256:	638FED787D3AA7A48B9D5354326D1FA94ED3EE26FF201674F67EB1BDBBFE2350
SHA-512:	C7870E589191151D6525A4B28E78610CFA557DB6CED1834D6173E0F1344F6F5EE03FDFEF783231B453AB382F5FA71B679596C7919E06D497CF0B4D1F127322B9
Malicious:	false
Preview:	.......... ........yX6DY.8......:..kOZm...................?.c?.S?.s..K..k..[..{..G..g..W..w..O..o.._.......`................................\.q.....<{......\|......7...W.Q...;.._)._;....I1.i........<.k..t.S...vv%/.P0+[... ....z.........6.au...n.Q.C:d.A<X.d.}.L.$...[A8.RaY..W...M.....-...xc.4...v.CI+.@.B-.....~.... .[...T.....M...a..tdq"_.Wq4.\|+.}......np....f...@..R.m.i.%)....?.....D......a.i.L.6.3.tO_.;%.cP.H.t ./.7...dm.W=.....C..+{...bO...."..2. .M.("-j.....!j.....V!i..xsqi&lB\.>.......m..=TEv.A.{>.4..Wp.()......\|_....b.r.a.!..e..NI...8v..... .)aB.........U....pt......$..,.e.zF..Y.QFD.......J.....j__."+..i..../...n..fk.N.I3X.%.@.........o........[...6.tKh...T...xBTl..2i@yW.;..~.HWB.p#[....R..!.& ...E...= M.y`D....._.._.H...'.W....m.8YHl[..h......~..kX....<.......U.....P....G.Br..<../.C.......!.......ht...c)6.QE^J....o3D..u.%]........I.]...[]...]w.y.*......._...H....O..%...v^;....../@.....I.............^y)..1..8.b.m=.FH.."K.$....T.t.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Cache\Cache_Data\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulUYwl:LsNfl
MD5:	909AEC79CB5006BEABAAEF682C6DC688
SHA1:	441437F287FC58AE5E54DAAA180F030A0414828B
SHA-256:	4A4BEB8C4E5D0F3596AB5462EBEBBB903B6F8BAC31A1BF11DA3F93953290B261
SHA-512:	924F307C96BD97DCA3739816CBBF5541D173B71BAFDF419E7A84F7E774F5AE5D84DC53AF52C53DD7D440E655123D492AEEDC8A68215F7D3D02A2DB7E05167182
Malicious:	false
Preview:	..........................................<.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\030a56d6f261fcec_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.38819686155935
Encrypted:	false
SSDEEP:	6:mKYYRiUKSVU4dJ4vAH6tFRlglXa0rwzFBpr:/tKSVVf446nUlXacwP
MD5:	CD95E131A20A59565CA0AD129CB38A1A
SHA1:	2E4701EDD155288ACA31F94E7014285CC743D38D
SHA-256:	092297996614ABC7DD14384FF2F4C2FA59451D974AEC64AD53A91D136E2554CB
SHA-512:	B86E3CB87D18A8F9A010571B3113F1AADAE25DFD77DB8B2A62F6F4B9703C9405E2756161D1B70B33E3399EEF5B8B379EDD52A83340E4FCD2C1A5022D98BA0E31
Malicious:	false
Preview:	0\r..m......W.....A....._keyhttps://web.whatsapp.com/vendor1~app.264a01b6133c4a120327.js .https://whatsapp.com/.A..Eo....................B=.q/.........Z...........$.a......._.W..(8C..9.N2..V...>....(2\|.A..Eo......)..u$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\158f5bd06717d691_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.360258411795432
Encrypted:	false
SSDEEP:	3:m+lZZ/la8RzY5GWWiKzRpBHEHRXERWEDAom5ktxKRPt/l9lwBLEXZ0TxWQmYk:m0/lXYYRicfEHd4vAH6txKRl3+BUK9a
MD5:	169B2CB7172DA7ED9605A869F88856F2
SHA1:	A22AF53E92101FB13DF6659481162DBC7F59161C
SHA-256:	89B985A342CA50FA59A9FFC15499C911CFBBB7B180196050CEF99AE1655BB620
SHA-512:	FEE7F40C455667C54E66119E626524BF98B9707DF9FC7EB96874989446AD806A41954DD68683784C947CE8E85CC3BBB21A0935A507DA69918F223FC083132FE7
Malicious:	false
Preview:	0\r..m......Q....XWu...._keyhttps://web.whatsapp.com/main~.f4046bd714178dbbb8c1.js .https://whatsapp.com/.A..Eo...................`.=.q/.........Z...........7.a.....mQ.c...5...../.._.x....W.m...y..A..Eo.........$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\252cfc6f27a294b1_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	5.361915815168435
Encrypted:	false
SSDEEP:	6:m4/YYRiGrHLUiPCVd4vAH6tGrRlfEc+0HAI/l:977LUsCb4464+4xt
MD5:	AC875F1D18B0733F04842AACE7D4AE47
SHA1:	25EDB7611705B401C68306F12C40854E3300C3CD
SHA-256:	B64EC6C2E4D7DB9850DB45BCFB4A7B437FFB1065278E3FF02E56799F31A1E476
SHA-512:	27F73949A90419898A9E245DB7418254C2C97C520E94E2C47CE612A8A2691008CDA74628DF34186C3C4388488158F26D9D4FA06994DC06F7841CDFA6C9EE78BE
Malicious:	false
Preview:	0\r..m......`.........._keyhttps://web.whatsapp.com/moment_locales/en-GB.1a0883d124f255e1ccfa.js .https://whatsapp.com/.A..Eo.....................=.q/.........Z.............a.....J..!9.B...nt!y?.N'17>.$=.i33.4.A..Eo.......a..$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\3c310027e3b85e7d_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.312357935880237
Encrypted:	false
SSDEEP:	6:mTXYYRinVxdJsd4vAH6tOLRlScEl3q9ot:Kraxde446sfs6o
MD5:	285C01CC398A25DE282370A8D6C1F268
SHA1:	2A68CAB2D7AE3A92E59BE1D5E8030D16E9801798
SHA-256:	3BE73BD8CEF8914839DC26893D2F38F5C04E105E82605FEFAF7FB7F42C0C4964
SHA-512:	B918E4C6C07A9264BB605F089BFC343E71156F9279082B2426D4C2E3355FAAF516B7036446948A8A8390E67B86D93E356A9D5D0B739EE31E548B736B7F433AC2
Malicious:	false
Preview:	0\r..m......P...m.[....._keyhttps://web.whatsapp.com/main.3d4bb07beea083ab8b3a.js .https://whatsapp.com/.A..Eo.....................=.q/.........Z.............a.......=..g....'wBG.@.`..k..1.5....s.A..Eo.........$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\5bc7517a7edef195_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.346188650328473
Encrypted:	false
SSDEEP:	6:msBr/VYYRiQOdkYDd4vAH6tJlgqFCpvClEk+4/Ll:Bt/J5Q446JFCZk+CL
MD5:	CC4C389FD5255E9FECF28C4373D598BC
SHA1:	1F2A568379F54469933A7764D6C09E9FD88097F9
SHA-256:	302486066512C274606732AFDF2DB38AC518AA4CCC36DED67113B13DB22ECA45
SHA-512:	20299CF6C861030845801CE59EF8DB70EF57378C9B2594CDB6AD713F4AEBC509064DA543689607B57E9D700F97E0700EC4D3D48048287D846D2C02D77A8B2B6C
Malicious:	false
Preview:	0\r..m......S...uo......_keyhttps://web.whatsapp.com/runtime.cf3d9387a416c75bf2cf.js .https://whatsapp.com/.A..Eo....................>=.q/.........Z.............a.......Ai}..H..e./5sF...q.+i.q..;p...A..Eo........Q.$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\69d5c4b8b78d9bc9_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.3343459649897
Encrypted:	false
SSDEEP:	6:mXltVYYRiUzdSd74vAH6tKVYC9lMKouxBm4:Cp0d7446AYC9d
MD5:	C4FE4997AB3C3F72E7053E1A825B2268
SHA1:	0BD1DF2A87D0C54411C171D31C45861C16A1FDA8
SHA-256:	98881C6C584A1F5178920F440D6542BD21ACC19962E1FF9418A0D59A0247A591
SHA-512:	BAF8CC1BA7927DFAC4F02B2F36EACF333F0AE2ED6B570C53A355480A6474FD6E53C3DEDDB04C30A3B4F3F9FCF36610115867E93D22EF78200817207B85F2F542
Malicious:	false
Preview:	0\r..m......U...5.A....._keyhttps://web.whatsapp.com/libsignal-protocol-ee5b8ba.min.js .https://whatsapp.com/.A..Eo...................0=.q/.........Z............a........H*+.....4;...`...;;k&...G.[`.A..Eo......FU{.$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\88268006280a6293_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.433585515943898
Encrypted:	false
SSDEEP:	6:mKLYYRiUKLGFSnb4vAH6tllnlQtnf9vjlU2v9pK4Z:5tK6F+b4460R9v9
MD5:	EA3B1DD566958D0FA73B181E46B9972A
SHA1:	73E0CF11E590D34360B5444EEFA42D02F54CF3A1
SHA-256:	FF782036635C8DD51D135AAC66FB108EBDD3C75080B4B3103E1820A85DC04D5B
SHA-512:	5C74014E4A3BD3C3B268DA988CE3290922834CE0B2B2DFD18B40D59E948EC251EA86B6F32B5787F3BE85C1573A4E25B5DE6AECFDE1F6B455E8F69B38526B335A
Malicious:	false
Preview:	0\r..m......X.........._keyhttps://web.whatsapp.com/vendors~main.75ffa609850dd95ab8d9.js .https://whatsapp.com/.A..Eo...................V.=.q/.........Z.............a......;.:0...~D.....\.....7}.5.4oQL..A..Eo......n..$$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\fe44f4c0e1d82fea_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.33367346518634
Encrypted:	false
SSDEEP:	6:mViYYRiui5AHX2b4vAH6tOv9le82oJ9P4:VBgUg446wcoJJ
MD5:	2960FAD66A0FD5830F15CB425F510D9D
SHA1:	7D9FF8D7B38C4887B40F6025040D58F5A702862E
SHA-256:	7348A3F9FCF591CD24531FCB6222B624DE4231A36B82C1DCF10F76F9D13A52C3
SHA-512:	6E94E90AE860C951457693D6C09E6D66F727FA66A63EF8B47DED4D73AC8780AEAB663295064962DDBCDE8C315F657B5C21F61B3B9156567A014E696FA3AC0E66
Malicious:	false
Preview:	0\r..m......O...M..B...._keyhttps://web.whatsapp.com/app.febe97f47327a63e0d22.js .https://whatsapp.com/.A..Eo....................N=.q/.........Z.............a.........aQ.O8....kW..Y.o...k.N..U..U.A..Eo........$.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.5339363845562275
Encrypted:	false
SSDEEP:	3:cdPys/vll/lwsBc+9MTlO1ucTloCKEM+ljl7YEpl/M6ORXT7297l3Llvbaln:cdNT1ClO1ucTliEM+Z+Ep0Te5Zbal
MD5:	AE37DCAAA8687837731D36898084D0DE
SHA1:	A80CB710083C9C2885BE9F315EB24DBAC6C5168E
SHA-256:	0C0484A962E5A583FB3E9B6B3F0B3D9F53CAF8304C200A56B452714789E7CC8B
SHA-512:	6D9DEA3FD1C2764CFC1D1EECA5A646187C0EFEFF0882957982A081C7D0076DCAF12B78CB3621219DB00D8FADA43C1580DC7330177EE81360A9970F4F620F87D1
Malicious:	false
Preview:	......)Hoy retne........................}^..'.1<@l.>.q/..........b.(..&...=.q/............g.[....=.q/............'o.,%...=.q/........../....D....=.q/...........a..V...!.=.q/............~zQ.[..g=.q/...............i..g=.q/..........5.>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.5339363845562275
Encrypted:	false
SSDEEP:	3:cdPys/vll/lwsBc+9MTlO1ucTloCKEM+ljl7YEpl/M6ORXT7297l3Llvbaln:cdNT1ClO1ucTliEM+Z+Ep0Te5Zbal
MD5:	AE37DCAAA8687837731D36898084D0DE
SHA1:	A80CB710083C9C2885BE9F315EB24DBAC6C5168E
SHA-256:	0C0484A962E5A583FB3E9B6B3F0B3D9F53CAF8304C200A56B452714789E7CC8B
SHA-512:	6D9DEA3FD1C2764CFC1D1EECA5A646187C0EFEFF0882957982A081C7D0076DCAF12B78CB3621219DB00D8FADA43C1580DC7330177EE81360A9970F4F620F87D1
Malicious:	false
Preview:	......)Hoy retne........................}^..'.1<@l.>.q/..........b.(..&...=.q/............g.[....=.q/............'o.,%...=.q/........../....D....=.q/...........a..V...!.=.q/............~zQ.[..g=.q/...............i..g=.q/..........5.>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RF622d2d.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.5339363845562275
Encrypted:	false
SSDEEP:	3:cdPys/vll/lwsBc+9MTlO1ucTloCKEM+ljl7YEpl/M6ORXT7297l3Llvbaln:cdNT1ClO1ucTliEM+Z+Ep0Te5Zbal
MD5:	AE37DCAAA8687837731D36898084D0DE
SHA1:	A80CB710083C9C2885BE9F315EB24DBAC6C5168E
SHA-256:	0C0484A962E5A583FB3E9B6B3F0B3D9F53CAF8304C200A56B452714789E7CC8B
SHA-512:	6D9DEA3FD1C2764CFC1D1EECA5A646187C0EFEFF0882957982A081C7D0076DCAF12B78CB3621219DB00D8FADA43C1580DC7330177EE81360A9970F4F620F87D1
Malicious:	false
Preview:	......)Hoy retne........................}^..'.1<@l.>.q/..........b.(..&...=.q/............g.[....=.q/............'o.,%...=.q/........../....D....=.q/...........a..V...!.=.q/............~zQ.[..g=.q/...............i..g=.q/..........5.>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\wasm\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\wasm\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:NGlKp0ELjn:U8Ljn
MD5:	C3FD558F58104BCB01CDA49007C0048B
SHA1:	3C543897CAE310654425189B884AB81DC06A8A9E
SHA-256:	03C2D008372016F78B36612C7BDB6BA632EE502B8488CC10D4938BB49BD89729
SHA-512:	2870D78AACCDF5448BCD30BDF4B9797DE3C8DFF1893977FA50053C0F788FB49768E30DFE67848BF4031CD633BD99C3C810F23FC87214E7D921B98D437B8317F3
Malicious:	false
Preview:	(.....b.oy retne..........................<.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:NGlKp0ELjn:U8Ljn
MD5:	C3FD558F58104BCB01CDA49007C0048B
SHA1:	3C543897CAE310654425189B884AB81DC06A8A9E
SHA-256:	03C2D008372016F78B36612C7BDB6BA632EE502B8488CC10D4938BB49BD89729
SHA-512:	2870D78AACCDF5448BCD30BDF4B9797DE3C8DFF1893977FA50053C0F788FB49768E30DFE67848BF4031CD633BD99C3C810F23FC87214E7D921B98D437B8317F3
Malicious:	false
Preview:	(.....b.oy retne..........................<.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DIPS

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4664995203625055
Encrypted:	false
SSDEEP:	24:TLUYFQq3qh7z3WMYziciNW9WkZ96UwOfBaDo:T4uQq3qh7z3bY2LNW9WMcUvB
MD5:	69E0285DE880B76F2A02244937A55FBD
SHA1:	6FDF99F25B4F33EBB8535BB1C1E34BFD9AF0A755
SHA-256:	C202E5B496F75FFE9F450A802AF648EF39839B7CAF8DF5F26594550876BA0CBB
SHA-512:	578166F6884702C56E06510AB80A4130BA4A2A7F0CD6F1B2D5B7AC38B07433205DF7ECB137DD6B878A238F573FFB0B8DF2F6EA9B36342E0CEBCE7EDAD3DEB0FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DawnCache\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DawnCache\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DawnCache\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\DawnCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlVT:Ls3V
MD5:	B786BA262424F9116EDBF4EFCD33D113
SHA1:	B2C0560C341D22B5C93CC906AE7CDE6A87D377E2
SHA-256:	31B0717AAAFB186563BB2C9FBD0C75510090784FD5710BEE9943182C45CDBB73
SHA-512:	98F1351AD231352CC1F876FEE217A485013F6D0A5048FF49DD776F67BF57F672E67EED8438E18F1769236138A461DC282C0F9F702F35E1F1E9744BCB87FB80CE
Malicious:	false
Preview:	........................................b\.<.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.2125929066629615
Encrypted:	false
SSDEEP:	6:Fg1wknaZ5KrWLYQV+dpaVdg2KLlvPhEQ+q2PwknaZ5KrWLYQV+dpaPrqIFUv:NrHUdHL38vYrHUdo3FUv
MD5:	E4964FD8B78F3DF0CA1AD90AEC2005C6
SHA1:	52AD48B50C82D4B5CACCF76A7B9D80AF43525688
SHA-256:	308C18EA671B2A0DEEEB3B5D38A08B29BF837AFF39687D9D92D80335FC22CEA9
SHA-512:	61FB61894D89218316B45CAABC41DC553CFDB3CC43DC0E1E99D5D7E54986E933E7641AD615775827B4973CCF576509BBCEC78B3AD26141B53D3FCF1ABD9A51A6
Malicious:	false
Preview:	2024/03/10-17:31:03.388 bf8 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules since it was missing..2024/03/10-17:31:03.462 bf8 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Rules\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.212454004761847
Encrypted:	false
SSDEEP:	6:F21wknaZ5KrWLYQV+dp6FB2KLlvHGQ+q2PwknaZ5KrWLYQV+dp65IFUv:LrHUdQFFLBSvYrHUdQWFUv
MD5:	4CA94ABF985457B054B6530CEEC6A1BE
SHA1:	42C2AC4ECEFA51F26EE5914DCA0CA553CE1D7561
SHA-256:	45F2A798BE5808D8F0419C62B9E0373EEE81B0247FE3A283ABDBC53AF92C0A43
SHA-512:	0BC9039DCF2D6DE2CFC8FF9520CC580019EB59D0B02E355F4BCBF336C6FD502A7E0096562B680D38594C7BFC3279D3C17F53BEA2F2461D8D1BF8939AC5223C10
Malicious:	false
Preview:	2024/03/10-17:31:03.720 bf8 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts since it was missing..2024/03/10-17:31:03.747 bf8 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension Scripts\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCT
MD5:	891A884B9FA2BFF4519F5F56D2A25D62
SHA1:	B54A3C12EE78510CB269FB1D863047DD8F571DEA
SHA-256:	E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
SHA-512:	CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2245721846527475
Encrypted:	false
SSDEEP:	6:F7q2PwknaZ5KrWLYQV+dpNIFUt88hPFZZmw+8nchkwOwknaZ5KrWLYQV+dp+eLJ:1vYrHUdwFUt84PX/+Rh5JrHUdPJ
MD5:	6C479AE02FAF4E9B1C432BFFF64F7157
SHA1:	D968F28010EBF06DBD07BC97F463199D95AEB019
SHA-256:	C3C040A9935E7CBB0AC5F2C36329F1DE7D12E38A23D2C5872F6899458A586763
SHA-512:	5353E75EA45CF57AFABADC452BA162AC1520B4F8C237B476D04E651BC100808720DC6E658E86F3953AD24D808DDEF1B99F9E4461CB9DD0E93AFF133F18695246
Malicious:	false
Preview:	2024/03/10-17:31:20.130 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State/MANIFEST-000001.2024/03/10-17:31:20.214 1960 Recovering log #3.2024/03/10-17:31:20.271 1960 Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2245721846527475
Encrypted:	false
SSDEEP:	6:F7q2PwknaZ5KrWLYQV+dpNIFUt88hPFZZmw+8nchkwOwknaZ5KrWLYQV+dp+eLJ:1vYrHUdwFUt84PX/+Rh5JrHUdPJ
MD5:	6C479AE02FAF4E9B1C432BFFF64F7157
SHA1:	D968F28010EBF06DBD07BC97F463199D95AEB019
SHA-256:	C3C040A9935E7CBB0AC5F2C36329F1DE7D12E38A23D2C5872F6899458A586763
SHA-512:	5353E75EA45CF57AFABADC452BA162AC1520B4F8C237B476D04E651BC100808720DC6E658E86F3953AD24D808DDEF1B99F9E4461CB9DD0E93AFF133F18695246
Malicious:	false
Preview:	2024/03/10-17:31:20.130 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State/MANIFEST-000001.2024/03/10-17:31:20.214 1960 Recovering log #3.2024/03/10-17:31:20.271 1960 Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Extension State\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\ExtensionActivityComp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\ExtensionActivityEdge

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Favicons

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 12, 1st free page 11, free pages 2, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.5862549202437328
Encrypted:	false
SSDEEP:	48:TBmw6fU1zBDjub3OeNB7k/XDPCl+iuI294SxYqn5kMJgfD/3:TBCyHu6SMLMWLRqb
MD5:	8318A8F6F58F58DA9DFA4654623B6A75
SHA1:	AD5887AED92AAFE874E14D5B6CE67558A2290F51
SHA-256:	F77B639E63CFB2317E659C9416A96F0CAEE4BDFC570C9119CDDC629564517152
SHA-512:	099152C0569BF913C8AE9B3B40AF9185ADD5959FAC93A69C49F48430057E77E4D8CA22F888D88C85337E04486E3B6B3B0F09CB56497F2EF501DF99F78DA388ED
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\.usage

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.4575187496394222
Encrypted:	false
SSDEEP:	3:ZlKwQsl:W
MD5:	35A6C3B4FE838413993C88D9DB65C73E
SHA1:	FBC0F9716FCDC03C7FCF908FED2C5ED73A5452F6
SHA-256:	DA74921979C4034FB77F61A6295C7C4D9A2196C831760D546E36AD959F240D23
SHA-512:	6AAD96386A306AFC8DFE170B4A84B7591E2F98F11FBEB5F81456E9CE806D3A7734B962F174E6B1904A23CE395F69C5809EF52B851BC0B5B207CB21BB974158D6
Malicious:	false
Preview:	....FSU5................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.216606671691378
Encrypted:	false
SSDEEP:	6:FpHAOq1wknaZ5KrWLYQV+d/9MRDVYRsL12KLlvpHLq2PwknaZ5KrWLYQV+d/9MRJ:31rHUd+ZV88BLPvYrHUd+ZV8U2FUv
MD5:	9CF4B2C2FB40019B32BCD4EB6F035044
SHA1:	7DEAE0D7FCACA05DBD83820F2F3EDAD8937E52C2
SHA-256:	37DED69DE7A85E287A38B71F7392FCF3830D837EA703321EB2BD14509EE21149
SHA-512:	A901E8379CF4FEF64AFC244C373E7066580B2ED3A1E903872CAEB65C2DCCFB06A7355ABEEBFA14CE1664713A54AF7EA902EC86D6F7BE7164A4B4D9A832A4C80D
Malicious:	false
Preview:	2024/03/10-17:31:36.252 1960 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths since it was missing..2024/03/10-17:31:36.267 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths/MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\000\t\Paths\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.71553573229993
Encrypted:	false
SSDEEP:	3:w1tsm1iIjRb/MlA1jNMsis71rVWihViVVn:w1tsmRFThVN5x4ihUVV
MD5:	5C8A5499075648DFFA516552873B2352
SHA1:	C5B03A008EFB5B59273849F051E015DC7CD8CA74
SHA-256:	0007C077FE33A7823DB950818CCDB0DEEFF2CAE75400427D5931D7AFC257F7DA
SHA-512:	A02BFBDAD13653D3994ED79C6D7BCF4070277FBA71A82F5E5629AA4945867EED73BC9538615E9B7BC4B0F0057888EB5D2BE479D9363BA4485FADF92072E9417B
Malicious:	false
Preview:	mP...................LAST_PATH.-1..X.@................LAST_PATH.000..ORIGIN:https_web.whatsapp.com_0.000

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.242892215049996
Encrypted:	false
SSDEEP:	6:FpHIFZF+q1wknaZ5KrWLYQV+d/9MRO2KLlvpHSq2PwknaZ5KrWLYQV+d/9MRgPRh:ea1rHUd+YLGvYrHUd+4uFUv
MD5:	77CF3F1ABB99A7C69FC2330495216D20
SHA1:	C305211DC8E28901600EE6E9FB5D172B39C9AA82
SHA-256:	B18D9457103307C95D17CFCF47DD7CD1D1605E8FF164036E4A9D72B9267C4FE4
SHA-512:	FAC643F995255C39C4432C4C17C01412314CD1A436D495AAF399DFB850FBD3464628118D0D739B3325B3A43DF3CA1D2AB97E29963342D88FEB77D26283BE2199
Malicious:	false
Preview:	2024/03/10-17:31:36.184 1960 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins since it was missing..2024/03/10-17:31:36.202 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins/MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\File System\Origins\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\GPUCache\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\GPUCache\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\GPUCache\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\GPUCache\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\GPUCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl:Ls3
MD5:	334A9B42CA0F3506D6A4EB2CFF510D0E
SHA1:	9403A5B5EDCA1B857921DFBCD5851FE69F802AF9
SHA-256:	75DDC5A3E8D1FB4FA2254752E4EA6C5E8FB2A231B6FDCB20163E3E2E246F11E3
SHA-512:	BA747ADF4DAC1AD40E9FB57AB175AEA2D25CD93FCA14BFFFEE88B848190BA88C9490CA39AF1577ABE4F63FB6A197799F312041DE84E00C6EA2EA41E158D62304
Malicious:	false
Preview:	.........................................X.<.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\History

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.568287664376106
Encrypted:	false
SSDEEP:	96:+HhMF9E6WyejzH+bDoYysX0IxQz9kHtpVJNlYDLjGQLBE3CeE0kEjq:+frhH+bDo3iN092TVJkXBBE3ybV
MD5:	E9FA47D5EA6A41534F8B52128916F2E9
SHA1:	23031E1989F4D7649FF0F4199B08AB3487D69033
SHA-256:	67A0239D7DD9BCDAB64ECC6598A95F75681DA5D200FDDB2C15EF961865B6690E
SHA-512:	3ACFDD453B043FD3BE8DB95E97F4A42AA4402CEAAFB816D12606F811390A6F2876953CDBF2B79676E9D2AC0F54F8E633EE12422D56745202E0FE962A01E72BAA
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	33222
Entropy (8bit):	4.693691706394156
Encrypted:	false
SSDEEP:	384:F5HQw8knMYCMymRMo8cXxoAUCtlqSsEgPfYjgz8nQ6Dlb5S9gp:FCw8knMjMyGMCXSTQMdEsBYQGb5S9gp
MD5:	2DEB03B16A72E092D81D9787CECE8B82
SHA1:	D4E270B899FDDBC6EB18C4CAED5D7E620306508A
SHA-256:	005871891DB03FA4012A05645A07B16A8734B091232A414BA0AACB27C8D6CB26
SHA-512:	D77783BAA187F29CE9545C681A716C903798390DFBD0B83AA8E68B9626565DA9CA1769A656A608BF70AF8FE18A1C2173502C233457733D1FAA16DE3B3DC8495E
Malicious:	false
Preview:	. ......................2.......".....................................!..n........................C.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..w.a.w.c.......................-M..............................2.......................2..........................v..............................2....l.o.g.s......2........l.i.n.e......2..........2..........2..........2..........2..........2.............l.o.g.s........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................l.o.g.s..>......................2..........d.....t.i.m.e.s.t.a.m.p......d...........d.........t.i.m.e.s.t.a.m.p......d...........2....................2...........2....................d.........2....................d.........2....................d.........2....................d.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000004.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	3426
Entropy (8bit):	4.030940638937285
Encrypted:	false
SSDEEP:	48:6TX3Pe3P8lTSBz//dPDdPPbjlXqGqe9VE/KNKon/jSjOPd4XNbNo4gh5cVYaNlHg:+nPmPhtlPpPs92qCo0A7p8+9TgJAW
MD5:	55FE4807471F29728D639036703D6E2E
SHA1:	1961E293628DCC209CB92E26ABD6807C5AC9597C
SHA-256:	B83C5674E4E1874F9964746173BC699B990324F3AF14F5177DF94A37C8BDB4AD
SHA-512:	8077783F0D2F094A46B3820F23F9A9F7ECF243865DB5BCA6ECE60EA8483A91C1345D61118BC89A1D62BDB0A485A60C300F91AC9D87748A081AECD7040EE2B6FF
Malicious:	false
Preview:	..........................Y.......................2.......................2.............................Q.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..f.t.s.-.s.t.o.r.a.g.e......2...........X.V.Q.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..f.t.s.-.s.t.o.r.a.g.e.......<..............................2.........2.....................e.k.......................;..-.....................2.......................2.............................S.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..j.o.b.s.-.s.t.o.r.a.g.e......2...........Z.X.S.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..j.o.b.s.-.s.t.o.r.a.g.e.....}.<..............................2.........2.....................ZSv...........................-....................2.......................2.............................e.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..l.r.u.-.m.e.d.i.a.-.s.t.o.r.a.g.e.-.i.d.b......2...........l.j.e.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000005.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	16077
Entropy (8bit):	6.448916313619731
Encrypted:	false
SSDEEP:	192:JogdLVLbcUArNra+uos+KM3UT7VwjBCbs0Ay3vHWhg8ZKVdrCAJK1/lS38GScE/A:ekLVLQUSaFjY484svy3v2C8uXMtcms8G
MD5:	9392A2EA35E4696C1890D3C805E5D63A
SHA1:	405C53486A926B755095BE8BC57B008A602FA0FE
SHA-256:	0AF1BA4D9BC85F99AEF3CD2DD185D528987C128B7FDBA07244FB2AE0D913945B
SHA-512:	83628E34B616C8760D28A775C8A541F00B8440D5703D2270B51C85725D930748972127AC4E89DEDC67130BB82881BEF12172519BD457D5C57581E2BBFFB95378
Malicious:	false
Preview:	. ............$...........................................................................................m..........,....................2....$...............D.2...K...........................Y.......2.....&..96/...........?.............G.4.....&\.Q.G........<.G.......&....G......2.G.......&....G..........2.......2<.....%.!7......_.L)....,.J....*.(!.....w.o.r.k.e.r._.w.a.m._.e.v.e.n.t.s...`.M..W.....I.C.....C 2.....a.N...".H...".....b.O...".G...".....c.P...".F...".....d.Q...".E...".....e.R...".D...".....f.S...".C..."..F@..g.T.&.1.B...1.....h.U.......A.......!.$.......i.V.....$.6....". .#....c%..e=.0m.e.t.a...j.W.0...5......!}.k.X...".4..."!}.l.Y...".3..."!}.m.Z...".2..."!}.n.[...".1..."..F9..o.\.&.1.0...1!..p.]..."./...".....q.^..."....."!}.r._..!}.-..=}.....s.`...#."...t ...d.....!k...#.!...#...u.b...#. ...#...v.c...#.....#..F$..w.d.'...........mZ(........x.e....................>=.....y.f.&!6....56..A3.z.g..."....."A3.{.h..."....."A3.\|.i..."....."A3.}.j..."....."!x.~.k..."....."J....

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000006.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	2383
Entropy (8bit):	4.3331083163799775
Encrypted:	false
SSDEEP:	48:A4G8N6fl5TSUIHtNbHRSL3agQ58OlkIt/6oT3iy8VpkyZVh9B0:L6fldSFtBGaJCOdz
MD5:	EB229A9381A6E623451456E51A9BA8EA
SHA1:	5637BD8C4F732348F56AFDA363FCC0875AF110F5
SHA-256:	04F72B7B0CC6C8EF6268C0F09845BD3F1E0B4F05456C98C0B18C0434757EDDC5
SHA-512:	95740500A0C4D0804811B8990774367C52D52D1D956D2725DE886B9434BDD3498E5746D377DDE4E3D6E376CA557DB11C21F377A0401CAC92BC8A5017352F85A8
Malicious:	false
Preview:	N.R*..G.................2..................?....................o".action".commit".name".WebcDbOpen".payload"K{"webcDbName":"wawc","webcDbOpenWasSuccess":true,"webcDbOpenNumAttempts":0}{.......2.!&............................................2.!..................2...........2.!..........................?.GH.\|..L.....................Q.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..w.a.w.c._.d.b._.e.n.c........................j..P.....................?.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..s.w.......................w..T.........................?........2..........2.!.......2.!..........................?......2.!..................2.......j.L..Y..........................2.#.....................2.#.......................m....\..........................2....k.e.y.s......2........i.d......2..........2..........2..........2..........2..........2.............k.e.y.s........2.#.........................2.#..................2........2.#..................2........

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000007.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	5.843098965729076
Encrypted:	false
SSDEEP:	24:Q+BsNO/mk75IHZG4o9MeDLetcdFDxZwOWWRb3Kf9/o7uIr410NOW0T:hBsNJw5qGxatO1DWWN/7b4WeT
MD5:	90D83098A2DB62C9A6243F757C3510BE
SHA1:	8B367A09CD2442B0E6D20F974854043930A9EF68
SHA-256:	A2AC2DC3A120E04B8C07CFB92D0D4C366E7BF253D5E7CC9E793519332EF595D8
SHA-512:	67288F8DA29C19FC785C4415AA3A787180259E900E63586F1004D95ECFDF1EB088F69978837A04B18B06E34AE1D49F12564627DE4F7D72E57146AEC37246FA5D
Malicious:	false
Preview:	...........@.........=.........8.....5.......0.....-.......(.....%....... ....................................................................5........2...B.&........................< ..........0.......2$..................2$..................2$..................2$........&......!..2$........2..... ....)..2........6......1..2$........>......9..2$..........v...A.$.............C........)j....../.......D. .X... ..V.Q. ....h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..f..P-.s.t.o.r.a.g.e............l...........ED...............Z.......X.S..... ..j.o.b.sF....2.....n........!=..................l...2..$.....$..j.e...].H..l.r.u.-.m.e.d.i.a>..(.-.i.d.b...2..........................%Y".Z......q..o.f.f.d>......2.....n..................%...X.........q.p.lF....2.....l..................'.%...^..$....\.W...(..s.i.g.n.aN....2...".r.........)R...../.%...F..,....D.?.....s.w...2....Z....a;...........7.%...X..4..... w.a.w.c._a,4._.e.n.c.........2.....2.s................?.%...^..<......w.H.k.e.rF

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000008.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	8046
Entropy (8bit):	6.468432873233568
Encrypted:	false
SSDEEP:	192:6qF6b/2y6rx461qibtKWhBdFYyYiyBujGNblTICMVk:6+C/2y6V4H4tZbEUqICGk
MD5:	D842EE673D1C89B686EDA090E4CFEBEF
SHA1:	3197768D2C99A8683917B78CDC851BC57B67D8AA
SHA-256:	6303427437F0456B64B101A1952B44CBD1175C446A39A1B3AD17E4A105FAD2E3
SHA-512:	F240A99BC6B03C654AE3DE43EF1A11E4217AE8A6367A8F9C78F4225CA3727DCC9A57BBCFDD81E06BADDF560F89038B93787619AAE15A566E58E0AC39B3C3B478
Malicious:	false
Preview:	. ............$.....................,.........2...3$...........".........:........................&...........6.....>.........{......v.............(.............................Z.......X.S...[...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..j.o.b.s.-.s.t.o.r.a.g.e..........2.......u.....................2...l.......j.e.....H..l.r.u.-.m.e.d.i.a>..4.-.i.d.b................................%2i......i..o.f.f.d>......2.....n..................%...X.......V.Q.b....q.p.lF....2.....l................'.%...^..$....\.W..(..s.i.g.n.aN....2...".r................/.%...F..,....D.?.....s.w...2...*.Z....a,.....c......2.....7.+...X..4..... w.a.w.c._a2(._.e.n.c...2...2.l.........)@.....?.%...^..<.....(w.o.r.k.e.rF....2...:.r....)X!_..G.. ...1#...4......9...7.[.......AW$..........a.(.......2...!-..0l.o.g.s..........<...l.i.n.e........!]......................b.)..8.. .......2.......................4.....m.....5......v.6...v.7.....8...V...[...!.....:...4...;..........f..4.l.1.0.n.....g......%..y.y.h.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000009.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1975
Entropy (8bit):	4.940962732528583
Encrypted:	false
SSDEEP:	48:F7yuqmH6Qxwl2ykteUt/T73/dpKWvHc+baMrt7/6G7YAxV++BJ:RVDkhBMrx6DAG+T
MD5:	840F68C90CEC3ADC9AC376B885C7245C
SHA1:	46728F1DD48D34D5825D38616E96C8D83A4B801D
SHA-256:	3EAFDCB3B98498AB56472D5829E4103C8EEA8B9E53B3EDEF595A29FD357E5E8F
SHA-512:	339AE1F5B6F7C950E9F0C15B3EB49C6FA8C1EE2490023E225D0248374E291633CCDF71029238BF676EEAE0BC22330659273A47D123D3B13F1CCCB79C12309A26
Malicious:	false
Preview:	.7................................2....p.p......2............2..........2..........2..........2..........2..........2.............p.p........2."............................2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2.".....................p.p.+.0..............................2....s.t.i.c.k.e.r.s......2............2..........2..........2..........2..........2..........2.............s.t.i.c.k.e.r.s........2.".......2."............................2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2."..................2........2.".....................s.t.i.c.k.e.r.s"-..Z....................2..................?....................o".key\K..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000010.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1587
Entropy (8bit):	6.146531418943893
Encrypted:	false
SSDEEP:	24:AHkKcia/XxDBxmYfZUuqOyhTlGnLdLMMmnlW8sJTWSFeuRzawH16p:AHkfiaxmYu6SoR+lW8KPgutDV6p
MD5:	4932C7D336A1B0E8B4C4F52D391E3C26
SHA1:	585DEAF64FB4BF1A9C229F3C52302BD601682914
SHA-256:	A6260E3C2168876904670F7150D8571BA2E2C9EFDF8750813F590353E9C8F378
SHA-512:	AB25BB9E3A625E6847ECDA3168FEB46E09BDB26B1FE67BA63C89A56BC2E036D21291CB8DD003450E66100896FF98F3F14BDECE84B167DC08FF291EF648767468
Malicious:	false
Preview:	..(.........P.........L.. ....2..........!.V.....&I..........;(...................."..J2......#.z......Z..2V.........L.....$.............................!.!...X..L........2..........W.. .............?.....K2..........J...T........".w.....#%.D......p.r.e.f.s....k.2../...../...../ 2........>..........>..........>..........>..........>..........>..........>........................................$#1......!..". .......f.t.s._.h.m.a.c._.k.e.y.s.......!1..%.....2.!......G!5..!.....>..!.....>..!.....>....5......~>&.!-...}>..!-...\|>.........{..%......E.....o.................n....M..m>.......l>.......k>.......j>..I..i>.......h>.......g>..I..f........I..[..1.A.0.C....h.t.t.pE.0w.e.b...w.h.aE.la.p.p...c.o.m._.0.@.1..s.w.Q.R...Y.*.K....w.a.wEy0d.b._.e.n.c.M.]......<...G.........U........$..H............o".action".commit".name".WebcDbOpen".payload"K{"w...N.#.:"wawc",...+<WasSuccess":true...LNumAttempts":0}{........T...$.........................A...p.......\.........Y.......N.........O.. ....2...]..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000011.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	9184
Entropy (8bit):	6.5296041518472645
Encrypted:	false
SSDEEP:	192:0D346nsSELsKaTzG+Vn+N/KWhg8ALzoE6U/kilS6yPw00KmbApwm:0r468Ra3GBN/ZC8ALUE6yuo5uV
MD5:	2B87032B65F2C82E0D976BA0E6463507
SHA1:	7CC92E6B831CC5C303DF0102C2C79069273BF48A
SHA-256:	5819C1B55571C31C8C8ED6DBDFA9EDA784A5CF2418ABB1674D78AE9416249235
SHA-512:	00AC87FB31B7830EC9CE657E0708980F3DE5F2E540E6422FD31AB733AA06B2F28A1FF70D22269569D085A220794BF076CFCC5CDE0085EDDD1D26ED23A2C2ECDE
Malicious:	false
Preview:	. ............$........P.............,.........2...3$....................................&...........6.....>...!.V...."...................#.z...............................7......2............ ......."....l.......j.e.1.q...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..l.r.u.-.m.e.d.i.a.-.s.t.o.r.a.g.e.-.i.d.b.......................(................%...Z.......X.S.L..$..o.f.f.d.:.............n..................%...X.......V.Q.....q.p.lF....2.....l........AE........'.%...^..$....\.W..(..s.i.g.n.aN....2...".r........A........./.%...F..,....D.?.....s.w...2...*.Z....a,....)......7.%.....X...2..$...4.$...\w.a.w.c._.d.b._.e.n.c...2...2.l................?.%....!..<.....(w.o.r.k.e.rF....2...:.r....)a!h....!.....X.%L........2..........W...............?.....K2..........J...T........".w.....#d...........p.r.e.f.s....... ..... 2........>..........>..........>..........>..........>......!...2.......>&.........>............A...........................$#1......!..". A^....f..._.h.m.aE.A..y

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000012.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	4659
Entropy (8bit):	4.239159693406475
Encrypted:	false
SSDEEP:	96:XHSiM0dvM/lEpXGFp0tkpijQa2m9J4osRiEP:iD0q/l4Ep0api0avSlPP
MD5:	2E61059A4E3D6819868E6426E860A16F
SHA1:	A7B388B6CF9B5FDBEAFDA30B19205991BC53422A
SHA-256:	726A8DF97D7EA007E87D391421277FAE62D5FFCF68ED7B85275E01E45F5CD517
SHA-512:	06E975EB01987317D602F20100AF719EA529E8D4628A799A1A0D75AFB72E3825A272A1899EC899EC2661FFC5811D5B81263F313C423F6D82D0A213B55C860C4C
Malicious:	false
Preview:	...}.........................W.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..s.i.g.n.a.l.-.s.t.o.r.a.g.e.....................9i.L......................F......2.,.....................2.,........................:...............................2....i.d.e.n.t.i.t.y.-.s.t.o.r.e......2........i.d.e.n.t.i.f.i.e.r......2..........2..........2..........2..........2..........2.....".......i.d.e.n.t.i.t.y.-.s.t.o.r.e........2.,.........................2.,..................2........2.,..................2........2.,..................2........2.,..................2........2.,..................2........2.,..................2........2.,..................2........2.,..................2........2.,.........&.$.".......i.d.e.n.t.i.t.y.-.s.t.o.r.eQ8.I..............................2..".s.i.g.n.a.l.-.m.e.t.a.-.s.t.o.r.e......2........k.e.y......2..........2..........2..........2..........2..........2.....(.......s.i.g.n.a.l.-.m.e.t.a.-.s.t.o.r.e........2.,............................2.,.........

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000013.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1444
Entropy (8bit):	6.568448491666601
Encrypted:	false
SSDEEP:	24:yoNPAtaV0QtOydAnWjV0Bedo2IB69GyHV6G7rXe1jS3vdWVBBmEjpxz:9ACiybjyedsMQy16G7ig1qtjXz
MD5:	4F3258268AECD59902E2C48DFB932F45
SHA1:	636C51ECD5BF22B8AC8A2926DED965C40CD99AB1
SHA-256:	1EBF46D2D9EC8B87E4CF733CDEFFA441C790EB61BFC8E981D8D5F01BFEEEB62B
SHA-512:	F159F1E4559D76574F7A00558B5294962F0A3925A16B5564CE33B563F29F3CA9669FEF508765BE7865D8683351B1BC1CE913C5EA230DF24CA54930A69750F212
Malicious:	false
Preview:	.........2............".....'.......&...........-(....................(...2...&....<..........J.....<.............................".!......\|...........s.t.i.c.k.e.r.s.......&.....& 2........>..........>..........>..........>..........>..........2.......>&.........>...................$...................,...p.p..................>........>........>..........>........>..........>........>.................'1......!H.......2............. .........!t$...?......2...........(.2..c.....,.c......(....:#.............:....2..............w...w ........................%......................................=..........!............o".key\K.. .....zH. .+,/..K'8.....y..E.-..\|oP....a..1...M.O.U.......j.....r......kLiG.....g_..q......Q.$..&...,ni....(.%...9W.>.@."._expirationN.p.b.yB{......K..=...........=h.........J....[.eT....7f..3R=.[..M..(..IF...A..'.....g.?.*...k/.{....7.:l.c.0b~^..U..!.G.C."..lil..P....X.:...5Jg..#N./.....F..\|..i.\^>%.g`{.....Ka.U...... ................a....... ....

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000014.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	9886
Entropy (8bit):	6.654220424852652
Encrypted:	false
SSDEEP:	192:0zYsbC4yCMdScby4OSkKvtsm+iKWhg8S+FrNPlSXQHYcwMipPk9jQci2:UBbC11ryvHKvaZiZC8/pxOQ4pk9ti2
MD5:	7523E7DAD4A8F816E2E59D4513D69BB8
SHA1:	486D4B54373E95A16FF117B4FB7EDE288DDF30B9
SHA-256:	9C45DBAE62A83D626D004120FE8F96E53273F7BFADDC90834B54C36AFDAD97BB
SHA-512:	147EFFF7290F7743582F0F412E7FD1096C69D9FEAC9B7B82783270360F6562E40B03367D8EC7D0AF97680CCB7C390759C1BAD8E58ACF60290BFCE9FC86532047
Malicious:	false
Preview:	. ............$........P.............,.........2...3$..............................&...........6.....>...!.V...".....#.z...'.....(...........2...........X..............................%....#.....Z.......X.S.V.X...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..o.f.f.d.-.s.t.o.r.a.g.e................n..................%...X.......V.Q.K.....q.p.lF...........l................'.%...^..$....\.W..(..s.i.g.n.aN....2...".r................/.%...F..,....D.?.....s.w...2...*.Z....I..........7.%...X..4.....\w.a.w.c._.d.b._.e.n.c...2...2.l.........!...!@..2.....?.+...^..<.....(w.o.r.k.e.rF....2...:.r....)X!_....!.....X.%L........2..........W...............?.....K2..........J...T........".w.....#$.............i.c...s.......&.....& 2........>..........>..........>..........>..........>..........>..........>......E..2........&.......$...................,...p.p..................>........>........>........>........>........>........>............................... ..p.r.e.f%...... ..........>....

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000015.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	3.867416073139315
Encrypted:	false
SSDEEP:	12:P8gDLBlvuHJ3Dlz8gDLBlc9aQEgDLBl5mqcmukZPhn:EgDLjiPYgDLjccdgDLjJcdkZPhn
MD5:	B24FBCCA63551FE1DC7ABAF2444E71D2
SHA1:	F8ADA08149B9A7F8B7CC3D2D33D0DBCC2D09B402
SHA-256:	A852788DC75657FC106CDE9430FF73B1876F8C27CD508C5BFCFCF372128DA045
SHA-512:	6EC3719F2C52896312841DA3AA2C13A4099984938AC5C85A8CCE8BAC656773132BF9F9329E7395464C9724E3E5898D5BDEB8626E98759BFF794B3B8C0B9C36C2
Malicious:	false
Preview:	(\|\| .........................U.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..m.o.d.e.l.-.s.t.o.r.a.g.e..................../O.@.....................2./.....................2./...........................U.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..m.o.d.e.l.-.s.t.o.r.a.g.e......2./.........\.Z.U.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..m.o.d.e.l.-.s.t.o.r.a.g.e...aY..<..............................2./.......2./...................$..C..........................'....................2.................2..>..;>....................2.................2.........................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000016.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	PGP symmetric key encrypted data - Plaintext or unencrypted data
Category:	dropped
Size (bytes):	2690
Entropy (8bit):	6.126308611646002
Encrypted:	false
SSDEEP:	48:tCmHeOdHZtt/mn5K8mvCrn6sVkZDYRbLn50T0sGBg5t0k3U8950Xh+EOZtcel2lk:tn+yvtenMc6sKYRez8mdxZG2f
MD5:	A7F776E36B748271AD5FF999FD26EE7E
SHA1:	0F08211B7F7B337C347CCF2553008C37DE4BB040
SHA-256:	EBD230DA134A86A979A3E2D82DE1A3B8DB938588ED649022BF308EB510C13378
SHA-512:	6D791C1536DD1D88664FD03A4D4718523D2A8FF302606F17E9B1347052B5F08256FB215FEDDE95C135C6C7C636B0D1DF8DDF476345E42D140B7DCFD6E79C901C
Malicious:	false
Preview:	. (.............(.....2...........,..........%........!..........F...................................,.!.......X0...d.........B..........B..........B..................`,2.......(.......&.$......s.e.n.d.e.r.k.e.y.-.s.t.o.r.e.............N.........K.........~>........A.2.5....}>&........\|>.........{>.........z>.........y>.........x.........$.........m..5...%....lB..!....kB..!....jB..!....i..5...)..$..c....". ......b.a%..KJ.....b.01r..!....a>..!....`>........._>....F.....^>&.!....]>..!....\>..!....[>..!....Z..=.....0..O......,%.@..s.i.g.n.e.d.-.pA.R.....N.<1...!....M>..!....L>..!....K>..A....J>..!....I>..!....H>..!....G>..!....F..=.....$..;..].a..s%..o.n...F.....:.?1...!....9>..!....8>..!....7>..!....6>..!....5>..!....4>..!....3>..!....2..=....."..'.... ..E...j.....&...........%>.......$>.......#>.......">.......!>....F..... >&.!.....>..!.......=.....,.......*.(%...E.a(0a.l.-.m.e.t.a.$.........81...!.....>..!.....>..!.....>..!.....>..!.....>..A.....>..!.....>..!.......=.....&......$."%..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000017.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	12033
Entropy (8bit):	6.620615318852127
Encrypted:	false
SSDEEP:	192:we6zEIWlb4sStYsK9rW5zYHOSVLrrhpihL+g4UMkmpjoVi1Vl69+UFto+gR0QL6H:L6zgS1PUrWJ+OSVXt8yvUboaCZU/Tgaf
MD5:	7C224706A813D90DBB6B8AA95BC8FCB4
SHA1:	B578DAFD948C5C72D523A90BD6021D66CCBCBE56
SHA-256:	A212CB52CD646A74C0BEDF2A6E184134DBF83EB6AF7DF4334FFDE76BE1B4A75F
SHA-512:	B97CFC992E92B7D29865FBE8FBC9D49ACD35D88222E010E335EBAFA7EA8830970D10856B9484BF7DF8B9539B302E97C212D0DA7C1BF88C10718C19FC111514A9
Malicious:	false
Preview:	. ............$......................,.........2...3$........................&...........6.....>...!.V...".....#.z...'.....(.....,...........2..........'X..............................%....I....X.......V.Q.V.R...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..q.p.l.-.s.t.o.r.a.g.e...........l................'.%...^..$....\.W.....(..s.i.g.n.aN....2...".r................/.%...F..,....D.?.....s.w...2...*.Z....)..........7.%...X..4.....\w.a.w.c._.d.b._.e.n.c...2...2.l................?.%...^..<.....(w.o.r.k.e.rF....2...:.r....)R!Y....!..2.!.....X.+L........2..........W............L..?.....K2...i......J...T........".w.....#$..........ec.i.c...s.......&.....& 2........>..........>..........>..........>..........>..........>..........>...................$...................,...p.p...............Af..2.56....>&.......>........>........>........>........>........>............................. ..p.r.e.f%...... ....!.....>........>........>........>........>........>....F......>&...........a

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000018.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	3.003378898733327
Encrypted:	false
SSDEEP:	3:Q//tl/lfXn+MllSXk+XW4SjXllx1ltXn5/R+FXn5/RRgml1g:Q//teMllkkoKjXlh+Rgmlq
MD5:	CF487E043817B1D58B1A21E929D20A0C
SHA1:	44F92F7E5B3206E7611FD8EBC560DDEE26FF804A
SHA-256:	E4F4AD5F11DE0792F91399D38737F4B006CD2657825AC22A16B37402B1248D2F
SHA-512:	8363E92D387E2A64968D3482C74DDC7D34A7463F0950A3BDF6174BC69EF59660D1511C8A6758601FC8981CBDA1D3DEF878C14D886A41212B9EB185D10CE6C536
Malicious:	false
Preview:	....'....................2.................2..2..>....................2.................2.........................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000019.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.201666711396022
Encrypted:	false
SSDEEP:	12:KSCYfNKB+XIX9GDLBlm4r8sq9X8YW5/A4YuF:KOfVEGDLjm4wMys
MD5:	16640E8FB08F9E6BAE8E399BC4E46A44
SHA1:	FE845B6A258161A60C722C74BFD9A21A11CC8DAA
SHA-256:	8795861EEA65AB96806C4E810C8601DAAA92E2133FEDFDFB921DD29240249CEB
SHA-512:	8FB249EA92ADEE3912D9583A18D582764A71CB13333B2381286D6D14D11F172532E050E3A517CFCEF153424452AA848C25AFF6AA88CB95194C12989A140C13DF
Malicious:	false
Preview:	..(................................$.....2........../...................I.........._.....$............................./.!...............\........Z.U.[.[...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..m.o.d.e.l.-.s.t.o.r.a.g.e.................pD.................Y.{.F{.....l.U......$.....................!...................0..............'....Z...m.........A.....t............bL..".filter.leveldb.BuiltinBloomFilter2..!...........\..............................y....0.....................................W...$uG.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000020.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	6.613049220839744
Encrypted:	false
SSDEEP:	192:MBjU+5lGq3Vja7U6JTIeJ8svaM2bvEwWmParhrgwBg4UMkmpjoVi1Vl69+UFtoPh:cjU+5JYPMeJ8qaM2bc8atUqvUboaCZUC
MD5:	0FCA0AFF41ABDC43B8E03C6DCE98F2E6
SHA1:	1AE2FECBDB30FED008C6BDF48B63AA31C560520D
SHA-256:	2D76E57AC3B78662BA08537F57C07A83FD4EC40F0D9A6CB2872A9C72F82EE84A
SHA-512:	5EE5BB27D007593965CF60E9D2812D185DF7B72F98297F7799759D045F18117C3D9E2AD8D5EEE6D73D5ED5C3AD3B1BC80AB513284D9D1915F3437C61EAF7EBB3
Malicious:	false
Preview:	. ............$......................,.........2...3(............"......&...........6.....>...!.V...".....#.z...'.....(.....,......../...........2..........3X............................'.%....I....^..$....\.W.V.X...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..s.i.g.n.a.l.-.s.t.o.r.a.g.e.........".r................/.%...F..,....D.?........s.w...2...*.Z....)@.........7.%...X..4....V.Q..d..w.a.w.c._.d.b._.e.n.c...2...2.l................?.%...^..<.....,w.o.r.k.e.r.B....2...:.r....)R!Y....!.....X.%L........2..........W...........m...?.....K2..q...?...!..2..c...J.,.c........".......#D...........s.t.i.c...s.......&.....& 2........>..........>..........>..........>..........>..........>..........>...................$...................,...p.p..................>........>........>......A...2.5{....>&.......>........>........>............................. ..p.r.e.f%...... ..........>........>........>..!.....>........>........>........>............a.............1........$i&.#q......'..

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000021.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	3.0347670767719075
Encrypted:	false
SSDEEP:	3:hWX/lfXn5zXk5j9Q/x1ltXn4AjFXn4AQgHhOAn:hW/k5jWMA2AQgBOA
MD5:	CFB281C2C25EEBB0903CB6BA3F5EB3B7
SHA1:	5967ED4B63508006E079CF18AC95BAFB1F42FFDF
SHA-256:	984B712F4016883E3AAA086588D76E92C68807EFFD12BD9ADE6E260100855581
SHA-512:	E7F4DE130C4A55FFF169020DF61D4C069F9A9CAFD37E39C2ABB8A58706B2DCDFE180659C3C19509C003C05C15FE4676C85207A64BB22982D39E2A3D30A767E6F
Malicious:	false
Preview:	.vm.'....................2.................2..S...>....................2.................2.........................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000022.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.457370184712067
Encrypted:	false
SSDEEP:	6:UlDHpbVxogQl94K/Ml3gLJnUIR8/AXqiM4zlYfH:UTHo7l2Kkl3gG5/AhM4zlEH
MD5:	A85C903871EC3E5D9152370DC2F431AF
SHA1:	553A8815386C356522A6AA84AF36C4E9C38DEC27
SHA-256:	834BCF1924A073C5F59757CBDE18B5B86F1504A26B2A3D9646795D86426AAD19
SHA-512:	AC42630E90CA8628B6A1AA139F7A0775F128F5375BB590FC7D96F96CD736967B175B305F161A12AD25663DD18B806E0B2B3337E22E44BBA4C5B10311446581CE
Malicious:	false
Preview:	l.......2.................................................. ...........L......................Q9.I.....*.................".filter.leveldb.BuiltinBloomFilter2a............L.................\...........<.x/......................................W...$uG.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000023.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	12033
Entropy (8bit):	6.622681309184873
Encrypted:	false
SSDEEP:	192:slDsufC7e7+d3ABXw9UX+R7Bi+wc4zYmXYM3xoaLWKNmUvkLpjkcflzybpCxDAgG:QsufC7Dd3ykR7BUc43RGa6KoU8FTlNWH
MD5:	9BF604294C422578832A9D8810373CDC
SHA1:	1E573ACE25EBE1CD86B5AC091400DFE48AD3CCBF
SHA-256:	B9A3314D2F2DCF18B2F5C13F21B5B2B404066F45D63BDF5384F6B7397296D11E
SHA-512:	394B31844DD1CB493BE44C6851E4D336E3AD84A3CBEA849FC98A370CD2C2004B3875DF1B4D0CFA43BC7C2E277DD57F0270EDA61253008D432A19C3CA45D67CA7
Malicious:	false
Preview:	. ............$......................,.........2...3(.........&.."............6.....>...!.V...".....#.z...'.....(.....,......../................"..0....................2........../.+....J....F..,....D.?.7.@...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..s.w.........*.Z..................7.%...X..4....V.Q.....h..w.a.w.c._.d.b._.e.n.c........2.l................?.%...^..<....\.W..H..w.o.r.k.e.r.-.s.t...a.g.e...2...:.r....)R!Y....!.....X.%L........2..........W...........M...?.....K2..q.......J...T........".w.....#$.............i.c...s.......&.....& 2........>......!...2..c....>&.........>..........>..........>..........>..........>...................$...................,...p.p..................>..........>........>........>........>........>........>......a.........&................... ..p.r.e.f%...... ..........>........>........>........>........>........>........>............a.....3.......1........$#q......!..". .M....f.<._.h.m.a..a..y%......0!...!r!.....>..!.....>....u-......>

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000024.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	3.034767076771908
Encrypted:	false
SSDEEP:	3:3Nlltl/lfXn4slAXk4+Siallx1ltXn7S9FXn7Sqgrleg:33ltYslyk+ialogx/
MD5:	D271B625E4E23917E6D3ED85BD8C7FB4
SHA1:	E9263839019F601FF43537B5BBBAEB7A25534B5C
SHA-256:	25860E438F33FB1344CB357C601DD5CD70FFACC7675313B82F9D632FB0B02909
SHA-512:	7142132E91D1F1AF8CCBD137060082B00F93827D1472E1246B73016ED5A0B9098B0D0A64125B52E5089006EB08EE1DD5D59852D14FE06A10C7186F75A4239211
Malicious:	false
Preview:	.}_.'....................2.................2...w.0>....................2.................2.........................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000025.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.397253347357832
Encrypted:	false
SSDEEP:	6:UlDBkv3SlLHMWgvl/11almMLJnUIR8/AXsEflFlal/qKXQ:Uzk6lLH4/jalmMG5/AcENFlu/qZ
MD5:	687AA21DFF855CF34273447B09FBF144
SHA1:	9BC863F8184D83249A9DD1CE994431154F803465
SHA-256:	EB7D7DB5C5334860B42469DFFFA24C265F86F7A7D482F1B4BEAE7FF74C742DFB
SHA-512:	FE9713E7E45B21529509078E719E2368AF637E7EAD7569DF2D675365D77D6CE7F0D9F4AF1AEA5275650F946F00762660B9D51B9A7C008C8F540E0C0C5AFB7BE0
Malicious:	false
Preview:	l.......2................................................ ...........L......................M3F......"...............J.".filter.leveldb.BuiltinBloomFilter2_.............\.................Z..........2..v/......................................W...$uG.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000026.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	11862
Entropy (8bit):	6.616422972933002
Encrypted:	false
SSDEEP:	192:VouzFWI4RKtFuZ11qEdZ8sV4Z5i5Yw1pLW7aUaUGi3kjoHUVow9VDGIyYAr2jQGE:CuzFWzRK7nq8qY5Dwb6HaUj0xiyhjFid
MD5:	5068A8B51309FF52838942C3F861B831
SHA1:	5160FFB5CA9A7F8DC3A951D0929CC619B24F0535
SHA-256:	49181AA536C0305C48EAABE4E7EB612C94E1FED8C27D45C639E2D1F9F839F0A9
SHA-512:	908B83C2C8AB1F4287B70282040C06F40878712E1D6D454BC340F8A9E20951B5989FA74E85452B5078B7086401DC9746ACEE925D45964374876744CC52D726FC
Malicious:	false
Preview:	. ............$......................,.........2...3(............"......6.....>...!.V...".....#.z...'.....(.....,......../................*..X............................7.%....D....X...2..$...4.$..V.Q...R...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..w.a.w.c._.d.b._.e.n.c.........2.l................?.%.....^..<....\.W.....H..w.o.r.k.e.r.-.s.t...a.g.e...2...:.r....)a!h....!.....X.%L........2..........W...........MR..?.....K2..Qo......J...T........".w.....#$.............i.c...s.......&.....& 2........>..........>..........>..........>..........>......!...2.......>&.........>...................$...................,...p.p..................>........>........>........>........>..........>........>............................. ..p.r.e.f%...... ..........>....F......>&.......>........>........>........>........>............a.$............1........$#q......!..". .M....f..._.h.m.a..a..y%-.....0!-..A.!-....>..I...>..!.....>..!.....>..!....~>..!....}>....5......\|>&.I,.{..%....a........o

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000027.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	3.0347670767719075
Encrypted:	false
SSDEEP:	3:KCiX/lfXn7MloXk75Ublkh/x1ltXn6/R+FXn6/RRgggh:KCiWck75CcO/3/Pg/h
MD5:	CAA63966F0F1FE14C5CEB9CAB5436659
SHA1:	72EADA912529E8F3E8A8277ED5352789396345B8
SHA-256:	A516323E4750A8D4AFF3C2264566B4963E5FDF0A4321033F6F0A9A7C6BFB08EF
SHA-512:	F8ED35D9D42D33989B722FBBD2B481D08680FDC9196AD0C62FC59147B2EA93B41B3C3D23068308E0633DE218BDEAF9F88DBE2C725F1679D47CE05B5085E5E6C8
Malicious:	false
Preview:	*..z'....................2.................2....$.>....................2.................2.........................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000028.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.4931094850738
Encrypted:	false
SSDEEP:	6:UlDBNdgrsPsjhRl9ZGvDgijLJnUIR8/AXsEflTl/lSTw6d:UvNdgrlHlj4DgQG5/AcENTZlSTw6d
MD5:	9B0D08E4F411FF0954B346B41F79F8AB
SHA1:	A95C2B71EC9BC667349D793775E2A689758EF381
SHA-256:	A9F8DDF0C131A8B5F76F6A00B37810F006E854CE9CB05AD79796E211F594D508
SHA-512:	31D012AD6E9B19B28D06226A3B71365E53ADA1A7B35DD06FA8F8E267EA1A2DBD3B1CC03999D646E830B6BF752337F9022633F8D10EC4DF11CEA37953DA892179
Malicious:	false
Preview:	l.......2................................................ ...........L.....................s...^.9.".$.............,.'.".filter.leveldb.BuiltinBloomFilter2_.............\.................Z...........[^v/......................................W...$uG.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000029.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	11819
Entropy (8bit):	6.604289020240758
Encrypted:	false
SSDEEP:	192:NSVDQSnCutebk4uUYix13H3LLWhXzSe5zBemkXe4oRwxdYrZykqpsZj1qLKw0R0g:EV3eb1uIx133L6RSe50VJOYsZj8LKwaX
MD5:	0EC76358D9A40A74729EFC9BD0AB5955
SHA1:	28325FF92FD4A2444E47D56C2B30779F2D9A94DB
SHA-256:	2521AB64BBA5EA982B52C0D7A1389A401079AF9EE15AD0BEC645714F2D00AC41
SHA-512:	083CE02A8E316E467345FBD3E5C82A7244F87F91F84CEF50F1C6ADAF6037CE32F3A29410DCD5FA468002B46546986FCF94AC5C7BCB07E82868E66C1CCA183D0F
Malicious:	false
Preview:	. ............$......................,.........2...3(.........6.."......>...!.V...".....#.z...'.....(.....,......../...........{....2..X............................?.%....D....^..<....\.W...a...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..w.o.r.k.e.r.-.s.t.o.r.a.g.e..........2.........:.y............!.....X.%L........2..........W...........-...?.....K2..1.......J...T........".w.....#D...........s.t.i.c...s.......&.....& 2........>..........>..........>..........>..........>..........>..........>...................$.......................!...AP..2.5......)..........>........>........>........>........>........>........>............................. ..p.r.e.f%...... ..........>........>........>........>........>....F......>&.......>..........................1........$#q......!..". .T....f..(_.h.m.a.c._e..y%-.....0!-..A9!-....>..!-....>..!-....>..!-....>..!-...~>..I..}>..!....\|>..I..{..%....a........o.................n.......5.5D...m>&......l>.......k>.......j>.......i>.......h>.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000030.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	5419
Entropy (8bit):	4.32254652526228
Encrypted:	false
SSDEEP:	96:35djDyqZQTHhkRMQJIevmlBlcldoqf2KeAtNw:HjuhktJIplBlUdoqn1Nw
MD5:	736FF323F24F5CB5B4BA16FD65AF6BFF
SHA1:	0E0021DFAD219ADE3AC07093B4BD1CB8EF5C0DF2
SHA-256:	82BC3F37247A534518A4120CEDBD1E725274EA262AACC2E041582863E20DA7A4
SHA-512:	54A8F0C29742CF6062D604A996C0BE8B7C049E2278F752C6C1667137CAAE239D3693A741EB074866688952C9012D2E7C51107C4ECBAE534BC258BD097D087E74
Malicious:	false
Preview:	5...8....................2.................7@....................o".lineI.".log"ZXS#- 2024-03-10 17:31:41.482:[warn][service-worker] l10n should not be included in worker!".timestampN...J..xB".countI.{.......2.1&............................................2.1..................2...........2.1.........................7@,...............................7@............J..xB........7@.........7@..... .......7@........7@.........7@......2.1.........................7@......2.1......................J..xB........7@......2.1................. .......7@........7@`#.......................2.................8@....................o".lineI0".log"GXS#- 2024-03-10 17:31:41.490:[log][service-worker] sw version: 2.2410.1".timestampN. .J..xB".countI0{.......2.1..................2...........2.1.........................8@G.].............................8@.......... .J..xB........8@.........8@..... .......8@........8@.........8@......2.1.........................8@......2.1.................... .J..xB........8@...

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000031.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.415169061091637
Encrypted:	false
SSDEEP:	6:UlDGWvQ7Kgal/12geGsljMLJnUIR8/AXsEfl52gl/q/4:UIWvB/cIG5/AcENv/q/4
MD5:	5F175C78B794649D321F9BB0A27F4E1D
SHA1:	7BA60F98BB9BD8C3025642FB522DEDEB4969A3FE
SHA-256:	452BF680622FAB2FA810665C47CA66F8310F39CB6F93D061BA682D652F831E23
SHA-512:	53864F07BA106ED061F4CAF5415BB89E7F14565110E3A97990362D3176DE852390AE3E1B685EC2F6C48CE793C33FD87DBD1FFC906815E12225839F62A843204D
Malicious:	false
Preview:	l.......2................................................ ...........L.....................S....EEt1...............Q...".filter.leveldb.BuiltinBloomFilter2_.............\.................Z............v/......................................W...$uG.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000032.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	11602
Entropy (8bit):	6.605951293804881
Encrypted:	false
SSDEEP:	192:bXhlrOVjSKepDbj+KrfkD15YMsstLWhoD6Sck+AAhhmhDfey9T/OGqHnhcM4eRa3:Vgpibj+KbkHYM16KOSHfZFaDHnaMnRa3
MD5:	1B5D47D2B9FCC8D508C183DAA3406654
SHA1:	30A71750B310B20353E02077000CFD627EEED318
SHA-256:	B225C4C480DCDBCB299A81D4449A7CF20B1C61E3EDA1532A7AD15BEC97B6979B
SHA-512:	1E7CFCCD8183B027E37CC8843AFF96C2E08F3552B449D2B9C2BF3E87A7D83CFF5AE0E9FD1B0968F2B337B5A7531308BA57E752FB701BF407EEF01B97D0B8A068
Malicious:	false
Preview:	. ............$......................,.........2...3(.........>.."....!.V...".....#.z...'.....(.....,...v..../...........o....:..X...................!........X.%L........2..........W...............?.....K2......?......2..c...J.,.c........".......#\|...........s.t.i.c.k.e.r.s.......&.....& 2........>..........>..........>..........>..........>..........>..........>...................$...................,...p.p..................>........>........>.......).5{....>&.......>........>........>............................. ..p.r.e.f%...... ..........>........>........>..!.....>........>........>........>..............-..........1........$)..#q......'l.". .......f.t.s._.h.m.a.c._e..y%$.....0!$....Q#..>..!$....>..!$....>..!$....>..!$...~>..!$...}>..!$...\|>..I..{..%....a........o.................n....M..m>.......l>.......k>.......j>....u(5....i>&......h>.......g>..I!.f........I!.[..1.A!....'Q......!..!..............:....2..............T....(.w..:#....w.....w..:w...2..:w......w...w..,.w......(....

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000033.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	Dyalog APL DFS component file 64-bit level 1 journaled checksummed version 15.-1
Category:	dropped
Size (bytes):	103301
Entropy (8bit):	4.54451451009375
Encrypted:	false
SSDEEP:	1536:94SK0153v5yCTnIf6yME+RcvS5/Um/cUeGfTBhIX1Yn:9tf5Af6yME+RcvS5/Um0Ue48X1Yn
MD5:	9C79952D2908FEE39615A322AE98047A
SHA1:	ABE586709DCD1470EA673EA89536F27543D173D6
SHA-256:	F849465DC077C5A3343CFBB7E76BA1BCCC2499789CAAC3E0BC4FC4FB175F4862
SHA-512:	CBFAF34D334F26B7525B6DC9E17190B6D21BFB8AABD76FB8A79B6DE0EA13ADA99EDF51DACCA0635C24C85225543ADF4E6D3116055D3470420D51D251533AB67E
Malicious:	false
Preview:	....'....................2./...............2./.........................2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1...............2.1..\|..........................U.......h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..m.o.d.e.l.-.s.t.o.r.a.g.e.....................}'.M..............................2.2.....................2.2........................k...............................2..".p.e.n.d.i.n.g.-.m.u.t.a.t.i.o.n.s......2........i.d......2..........2..........2..........2..........2..........2.....(.......p.e.n.d.i.n.g.-.m.u.t.a.t.i.o.n.s........2.2.........................2.2..................2.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000034.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	6.265495333540429
Encrypted:	false
SSDEEP:	48:S7pmTKFoICra3OsdfaOfaOfl8tfaOY+UavVxXo8LzlV1Rk/WZGj3BE/CZReiVTa3:S7pNFokeOPyOatyOhUedo0zlfaOZ63Bo
MD5:	E837FD348A13E155F307075DAE90B24E
SHA1:	90D5FF8B2F06F945F868FEEC3044D8E50C12F60B
SHA-256:	F14D47F82500C0B02E01E7D466D4C48C661816F3F0644FE1BBEE729A5604E9EC
SHA-512:	B5B60618B4C4058A26BD73987176B01D00E7A5428900015B9827BD4D6AC6E99B8A8B717CAF06D81981204960A1C37C449F6526467261BE3173C288C38F6C0122
Malicious:	false
Preview:	. .......2............!.....".-....#.....'.2...(.7...,.....1...H...&...........Q(............................<....!....................................".9...................z.2..'...................................................................................................F..... ........!.....".....#.....$.....%.....&.....'.....(.....).....*.....+.....,......#1.....)...................3.......................................%...........................................................F.....................'1#......E../.....0.....1......(.9.3...9.4.....5.....6......,.9...8........9.....:.....;.....<.....=.....W...>........?.....@.....A.....B.....C.....D.....E.....F.....G.....H.....I.....J.....K.....L.....M..F.....N........O.....P.....Q.....R.....S.....T.....U.....V.....W.....X.....Y.....Z.....[.....\.....]..F.....^........_.....`.....a.....b.....c.....d.....e.....f.....g.....h.....i.....j.....k.....l.....m......Um...n........o.....p.....q.....r.....s.....t.....u.....v.....w.....x...

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000035.ldb

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	10589
Entropy (8bit):	6.648636509194025
Encrypted:	false
SSDEEP:	192:2RVBf+AQVmGswtEg4UMkmpjoVMshYjRRlSWCgR9+CJ1DDLj39K90tDtNiqC:ivFQVH3KvUboaHhYvt3N/j39K9IDtNm
MD5:	8F0AD336D0CE0980A0F759856810F024
SHA1:	DEB67DE64D35728FDE0054332BE4FB1DE0A20C90
SHA-256:	18BE20E248F837652C0C1682F71230F873CC8E9269D5D65FFF185D864B463180
SHA-512:	9F40457D9516D7E8B67CA93A392E7CFA38BA4A0D4EBA036C1493FD1CD12E45B50331B7B5F82DDF90A4BE505E21E9780246BAA986EF24282C59665ECB08F2107E
Malicious:	false
Preview:	.!............$......................,.........2...3$......./........1........./.'.......X...................1..........%....... .w.;@..........2'.$.....J..xB.'.......'.........D.....2.....;@........L........2.............:...:...:......2'.......2...'......'6........2.....:@...!..2.59.....,2............:...9...9......2'.......2...'......'6........2.............2............:...8...8......2'..... .2...'......'6........2.............2............:...7...7......2'.......2...'......'6........2.............2....._ee.y...h.t.t.p.s._.w.e.b...w.h.a.t.s.a.p.p...c.o.m._.0.@.1..s.i.g.n.a.l.-.s.t.o.r.a.g.e.........:....s.w.Q.......:....w.a.w.c......:......<._.d.b._.e.n.c.M.8.....9...7..Y.......... ........... ....2......4.l.o.g.s........<....l.i.n.e.....e..T......d...............b.).. .. .........................4.....m.........5.....\...6...v.7.....8...\...[...!.v.:...4...;..........f..4.l.1.0.n.....g.. ....k.e.y...h...y.i.....j...y.......l.......m............(.u.s.e.r............6...............

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11305
Entropy (8bit):	4.911947155711213
Encrypted:	false
SSDEEP:	192:eoJw0ihE3LlqRiCYgab7ptq118Sgt+tFiWjsId:exPg4riE
MD5:	E00CCF5F4499284897EC032410BEF1EB
SHA1:	970F593AED000DA22856784130A681B656A17465
SHA-256:	0721F12066728CBF7252BCA4F3C170F128235506637241A0F2A203D83ECC297F
SHA-512:	3E861A37D0E553C1F274D5AB50324029ABD9BB8B5BC283B2520EACAAA4C5307330F799ED1F20F564558059482A431C5ADB0CCF945FAC494AF64FADEEBE05C768
Malicious:	false
Preview:	2024/03/10-17:31:35.097 1960 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb since it was missing..2024/03/10-17:31:35.140 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb/MANIFEST-000001.2024/03/10-17:31:41.667 1994 Level-0 table #5: started.2024/03/10-17:31:41.691 1994 Level-0 table #5: 16077 bytes OK.2024/03/10-17:31:41.692 1994 Delete type=0 #3.2024/03/10-17:31:41.693 1960 Manual compaction at level-0 from '\x00\x02\x00\x00\x00' @ 72057594037927935 : 1 .. '\x00\x03\x00\x00\x00' @ 0 : 0; will stop at (end).2024/03/10-17:31:41.709 19e8 Level-0 table #7: started.2024/03/10-17:31:41.784 19e8 Level-0 table #7: 1421 bytes OK.2024/03/10-17:31:41.788 19e8 Delete type=0 #4.2024/03/10-17:31:41.910 19fc Manual compaction at level-0 from '\x00\x03\x00\x00\x00' @ 72057594037927935 : 1 .. '\x00\x04\x00\x00

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1524
Entropy (8bit):	4.4401905858945545
Encrypted:	false
SSDEEP:	24:ZOF6LwCXCzcm/BQ4m/Bdm/B6hVDdi4DgrBmDfBJ3dyDjoq5bhQDyE5jedDiGXbgc:ZOIwFsSIVD04DgrBmDfBJ3dyD55KDyk0
MD5:	9542CCCDBF34ABDB2CFF9400F892A419
SHA1:	EA2C3E99F640770FA3DEE83A3D49C22323F94CC8
SHA-256:	4D78DE5459C9B536F37A66076CFD4299125469708ED331B921971674010FBE7C
SHA-512:	B5D60F9BAA0A3F93E5968D276DF67B9FA7B12330E826069B814CCB6D13B85F48872C54A6456EF4E2A772FACFD4B738309B501F257C71C201CE99EA6E9DA50F3E
Malicious:	false
Preview:	........idb_cmp1......Y.F...............}.......................................................@.............F......U.).@....................F................>.............................Z.5.......................P..............p.r.e.f.s.........P.IV.....................p.r.e.f.s..................G......................p.r.e.f.s........-.-.=.....................2..................s.t.i.c.k.e.r.s............b.....................s.t.i.c.k.e.r.s..................M......................s.t.i.c.k.e.r.s.........kj.Q..............................4.......s.i.g.n.e.d.-.p.r.e.k.e.y.-.s.t.o.r.e.E......Y%<...............4.......s.i.g.n.e.d.-.p.r.e.k.e.y.-.s.t.o.r.e.E................^..............4.......s.i.g.n.e.d.-.p.r.e.k.e.y.-.s.t.o.r.e.E........P*............................................z..@.....................................^............................N@..,.....................2..........................@.....................................^...............................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	156
Entropy (8bit):	5.303922389167117
Encrypted:	false
SSDEEP:	3:KTBll/4iM30kUk6iPWRGWWi1CO5Nm3VWf5GWWi+/efjZo3O5GWWi+gZ:KTp/4umvPWQRi1CmVYRiWefjZo3OYRiz
MD5:	EE836C23A8337B75C40BEAF5C4CC494C
SHA1:	DB78183AE6DDE2DA42EE9DCB34AA9CDE7FD3213C
SHA-256:	DE3A2BAB2DB5446B3E52B2A7FB5A2901B874D08EAEA85071A92D89F99EA934BB
SHA-512:	4593762CCFDFC1B9795BF27D057A12A9A53600AADE4C484B6AB7DF86124AA8741958A73AC9154AE6460461AC680D034F93B7194C89E0D018089D429EB612507A
Malicious:	false
Preview:	...................VERSION.1..META:https://web.whatsapp.com..........(_https://web.whatsapp.com..dexie_version..3.2.2. _https://web.whatsapp.com..INCOG

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.287634947429567
Encrypted:	false
SSDEEP:	6:Fr5TzL+q2PwknaZ5KrWLYQV+d1a2jMGIFUt88r3Wf1Zmw+8r3Z891LVkwOwknaZO:Z9n+vYrHUd1EFUt8e3Wf1/+e36V5JrHw
MD5:	3EF5D4BE00CF87A3C72EC40F037243EF
SHA1:	5D038B3104E22E129111DE054C35A7529F5900C1
SHA-256:	451B226DE8EC86D27C1F6D8DDE66F3FC46923592E0501D1B885FF8F2639F7374
SHA-512:	332DF2B16B097648F0071142730C49CA2FFE9932CC8F37A5EB3485500E12D71C3BFE2D495AC4FBB3A7D757057173AC2A917EEB2D399694790A31774B4DFC2D2B
Malicious:	false
Preview:	2024/03/10-17:31:19.769 c9c Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/10-17:31:19.933 c9c Recovering log #3.2024/03/10-17:31:19.960 c9c Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.287634947429567
Encrypted:	false
SSDEEP:	6:Fr5TzL+q2PwknaZ5KrWLYQV+d1a2jMGIFUt88r3Wf1Zmw+8r3Z891LVkwOwknaZO:Z9n+vYrHUd1EFUt8e3Wf1/+e36V5JrHw
MD5:	3EF5D4BE00CF87A3C72EC40F037243EF
SHA1:	5D038B3104E22E129111DE054C35A7529F5900C1
SHA-256:	451B226DE8EC86D27C1F6D8DDE66F3FC46923592E0501D1B885FF8F2639F7374
SHA-512:	332DF2B16B097648F0071142730C49CA2FFE9932CC8F37A5EB3485500E12D71C3BFE2D495AC4FBB3A7D757057173AC2A917EEB2D399694790A31774B4DFC2D2B
Malicious:	false
Preview:	2024/03/10-17:31:19.769 c9c Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/10-17:31:19.933 c9c Recovering log #3.2024/03/10-17:31:19.960 c9c Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Login Data

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 21, cookie 0xc, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	0.9009435143901008
Encrypted:	false
SSDEEP:	96:C2BeymwLCn8MouB6wzFlXqiEqUvJKLuyn:C2TLG7IwRFqidn
MD5:	FB3D677576C25FF04A308A1F627410B7
SHA1:	97D530911F9CB0C37717ABB145D748982ADA0440
SHA-256:	A79300470D18AF26E3C5B4F23F81915B92D490105CE84A8122BF8100EC0C7517
SHA-512:	ED6666B064958B107E55BD76E52D2E5BF7A4791379902D208EF909A6B68803240D372CE03641249EB917C241B36A5684656A48D099A8A084AD34BA009857B098
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network Action Predictor

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\14b4a460-ab6b-4f3e-a492-f459b57072eb.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.420232887450327
Encrypted:	false
SSDEEP:	3:YWRAWNj+gvJcDOofPwXq6FrUwBvT1Y9B8HQXwlm9yJUA6XcIR6RX77XMq/ddoKqw:YWyWNauJW/PeqyrUwBKB8wXwlmUUAnIi
MD5:	62E4052B9873C96A804DDB358E832939
SHA1:	F307E7184D747CB71D237A7E03A40658E7683245
SHA-256:	2240E3FBEE10E710CBEDC9A6D8C6EA9EA11701D42883A0C5F717A7AB0D5BB8DA
SHA-512:	CA02695C7C909F5C93DB065FEC1F40F2766178B95D09D5DCCAFCEDAA002EC9B1CE7E5DF495DACC55847AC05B04C3C82BC98BD1CECB73689F711AFE23E88AF4A2
Malicious:	false
Preview:	{"sts":[{"expiry":1741624301.927259,"host":"IN4MVOmjPvy672m6akZ9Q9TjfMfib7NqhGdJ6K/GKYU=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1710088301.927265}],"version":2}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\2f393ddb-9a4c-4575-a85a-ba6b433b52a3.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\383a706a-a2a7-45cf-9ec0-dce92bdf4f31.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\43706181-22d2-404d-a056-4e8c36410146.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\44a37570-da09-47f3-b8b5-cb6920a321ca.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\5c3bf6f2-d010-4e85-90be-0f48e7e0008c.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\7fbec224-668a-48af-8ebe-1751710b6830.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Cookies

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Network Persistent State (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Network Persistent State~RF61c5d8.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Reporting and NEL

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	modified
Size (bytes):	36864
Entropy (8bit):	1.121758664397137
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBx5L:eIEumQv8m1ccnvS6x50Ph50Dwh5wxP
MD5:	A7D2921C8B730DE43F274B172CC2CD66
SHA1:	F87F9F171201B23717498156580F2662ADA02075
SHA-256:	ABD8F8C8D70465ECDFB64C1913631251D6E712215DBACAEFDBF3EA232332490B
SHA-512:	2695819D79F1EC1BAC0E4BD3CE7194122FFE2A4ED9BB4525D27F179C321B69FF02AC4D113F7D22526550729C813C34D3FC3E6E35A3BD0567597008EAFBA54371
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports~RF615b66.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports~RF6194a6.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\SCT Auditing Pending Reports~RF619533.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Sdch Dictionaries (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Sdch Dictionaries~RF61bd3d.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\TransportSecurity (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.435640318047346
Encrypted:	false
SSDEEP:	3:YWRAWNj+0LWUkbsofPwXq6FrUwBvT1Y9B8HQXwlm9yJUA6XcIR6RX77XMq/ddNQG:YWyWNa0LWU41PeqyrUwBKB8wXwlmUUAb
MD5:	9E08E249AA3FCAE361A7C117C31F0647
SHA1:	034650082D2885072394C379437BCC38EFCC7F0A
SHA-256:	5F8E566B7A06D89B931A420E8D5F7B54CE1FC40E059AB36552AE647039D9004A
SHA-512:	B180B52B454B1017F8E23E326635106BBE122AB4F30585668198783CD7332621D451B4889BFB0162A64CEA961F7034E1F974458C9BC3BA4113D35C928B74AB8A
Malicious:	false
Preview:	{"sts":[{"expiry":1741624285.315497,"host":"IN4MVOmjPvy672m6akZ9Q9TjfMfib7NqhGdJ6K/GKYU=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1710088285.315502}],"version":2}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\TransportSecurity~RF61fc2a.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.435640318047346
Encrypted:	false
SSDEEP:	3:YWRAWNj+0LWUkbsofPwXq6FrUwBvT1Y9B8HQXwlm9yJUA6XcIR6RX77XMq/ddNQG:YWyWNa0LWU41PeqyrUwBKB8wXwlmUUAb
MD5:	9E08E249AA3FCAE361A7C117C31F0647
SHA1:	034650082D2885072394C379437BCC38EFCC7F0A
SHA-256:	5F8E566B7A06D89B931A420E8D5F7B54CE1FC40E059AB36552AE647039D9004A
SHA-512:	B180B52B454B1017F8E23E326635106BBE122AB4F30585668198783CD7332621D451B4889BFB0162A64CEA961F7034E1F974458C9BC3BA4113D35C928B74AB8A
Malicious:	false
Preview:	{"sts":[{"expiry":1741624285.315497,"host":"IN4MVOmjPvy672m6akZ9Q9TjfMfib7NqhGdJ6K/GKYU=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1710088285.315502}],"version":2}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\Trust Tokens

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\bf738948-5db4-488f-bd4b-334c6ebdc6f7.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.435640318047346
Encrypted:	false
SSDEEP:	3:YWRAWNj+0LWUkbsofPwXq6FrUwBvT1Y9B8HQXwlm9yJUA6XcIR6RX77XMq/ddNQG:YWyWNa0LWU41PeqyrUwBKB8wXwlmUUAb
MD5:	9E08E249AA3FCAE361A7C117C31F0647
SHA1:	034650082D2885072394C379437BCC38EFCC7F0A
SHA-256:	5F8E566B7A06D89B931A420E8D5F7B54CE1FC40E059AB36552AE647039D9004A
SHA-512:	B180B52B454B1017F8E23E326635106BBE122AB4F30585668198783CD7332621D451B4889BFB0162A64CEA961F7034E1F974458C9BC3BA4113D35C928B74AB8A
Malicious:	false
Preview:	{"sts":[{"expiry":1741624285.315497,"host":"IN4MVOmjPvy672m6akZ9Q9TjfMfib7NqhGdJ6K/GKYU=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1710088285.315502}],"version":2}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\c9ae3f99-4748-442f-8c2c-37ec1d322094.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Network\e60cee3e-b0d1-4d09-ba6f-f662720786eb.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Preferences (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5604
Entropy (8bit):	4.754422429722215
Encrypted:	false
SSDEEP:	96:stK/vL21s13UCa8zodY5eh6Cb7/x+6MhmuecmAeF9eIMR7K:styvksyCak+Y8bV+FiA4edhK
MD5:	6AAFD5AF934E4EFA8582F8CA35D166F8
SHA1:	835835ED12C40D04B23BCF72734E88766AE8A955
SHA-256:	11ED3989B8EF8E510CFEAC18F35CEC627B5F239EDC4E4C17F82FC20A31C0D57C
SHA-512:	310E043B27338FDB023038466A5890033550593AA81DAA9642EE402ECBE3EDFC72B71646FBEA1FB0C7A893FB40934B730B26317BB418291CDA1B908ED6224F9D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sit

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Preferences~RF61b6b5.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5604
Entropy (8bit):	4.754422429722215
Encrypted:	false
SSDEEP:	96:stK/vL21s13UCa8zodY5eh6Cb7/x+6MhmuecmAeF9eIMR7K:styvksyCak+Y8bV+FiA4edhK
MD5:	6AAFD5AF934E4EFA8582F8CA35D166F8
SHA1:	835835ED12C40D04B23BCF72734E88766AE8A955
SHA-256:	11ED3989B8EF8E510CFEAC18F35CEC627B5F239EDC4E4C17F82FC20A31C0D57C
SHA-512:	310E043B27338FDB023038466A5890033550593AA81DAA9642EE402ECBE3EDFC72B71646FBEA1FB0C7A893FB40934B730B26317BB418291CDA1B908ED6224F9D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sit

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Preferences~RF622fae.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5604
Entropy (8bit):	4.754422429722215
Encrypted:	false
SSDEEP:	96:stK/vL21s13UCa8zodY5eh6Cb7/x+6MhmuecmAeF9eIMR7K:styvksyCak+Y8bV+FiA4edhK
MD5:	6AAFD5AF934E4EFA8582F8CA35D166F8
SHA1:	835835ED12C40D04B23BCF72734E88766AE8A955
SHA-256:	11ED3989B8EF8E510CFEAC18F35CEC627B5F239EDC4E4C17F82FC20A31C0D57C
SHA-512:	310E043B27338FDB023038466A5890033550593AA81DAA9642EE402ECBE3EDFC72B71646FBEA1FB0C7A893FB40934B730B26317BB418291CDA1B908ED6224F9D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13354561864756333","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13354561864577512","domain_diversity":{"last_reporting_timestamp":"13354561863857231"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sit

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\PreferredApps

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\README

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Secure Preferences (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.579760184607159
Encrypted:	false
SSDEEP:	96:vkiAPlf/ROoBpkF5d1OiD7VaTEv9V5h5pg5vezodIU8PmSpsA5IOrMn3YPo0MG6q:NkrKF9l5PmSpFIOAn3go0iuN
MD5:	14B5DCE22494648DD6683EEDD5E5A1C5
SHA1:	FE7926A2E4AE31A534FAA75AADC9DF7D73B3B000
SHA-256:	9F76ED2DE31BAC2BF600F450DA85554D446DD316154E15619F94B32A2E9437DD
SHA-512:	90592B3C8C8E8F47C5EC204F60D379DB0D248F383A39A3F37344653FF47CB8FFAB5F790C2221B6F0D71BA4F86B2D241373AEDBDAF6470536ACD77571CF3AC538
Malicious:	false
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354561863316208","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354561863316208","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4061fcf7-5349-4f87-9296-9386dcb837bf\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4061fcf7-5349-4f87-9296-9386dcb837bf\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:RoC0EC7XKln:7gXKln
MD5:	D1C2708A9A8D1E928BB2FFFE8ABEA281
SHA1:	CF31E50B6151D2A405E5CBAB5E16444F4ED953EE
SHA-256:	74D538F2DB622A5325F98BBFD873B9762A37CD2B5715C419B7D6600EB94F11A1
SHA-512:	CF9A9071331FD3ABC9E9CF4FB96FAB8F64F0224C9F4007168C303FF75F4FFE9B97187850F304CF95BD15836C79DA5A18153B323959C08206C28DA61BD8985ED0
Malicious:	false
Preview:	(.......oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4061fcf7-5349-4f87-9296-9386dcb837bf\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:RoC0EC7XKln:7gXKln
MD5:	D1C2708A9A8D1E928BB2FFFE8ABEA281
SHA1:	CF31E50B6151D2A405E5CBAB5E16444F4ED953EE
SHA-256:	74D538F2DB622A5325F98BBFD873B9762A37CD2B5715C419B7D6600EB94F11A1
SHA-512:	CF9A9071331FD3ABC9E9CF4FB96FAB8F64F0224C9F4007168C303FF75F4FFE9B97187850F304CF95BD15836C79DA5A18153B323959C08206C28DA61BD8985ED0
Malicious:	false
Preview:	(.......oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4b935e02-f04e-4dd8-9236-bcac997cd382\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4b935e02-f04e-4dd8-9236-bcac997cd382\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:sZIAR0EPTn:syA9PTn
MD5:	9031118A3711AD9F5C4039735BB26E1C
SHA1:	21420EB4217B8F9276E692E36EAB465E938980D9
SHA-256:	23342A92402D371B6AFD11D2014F9BC85F5589DB64A6F5476F4BD288BE24C9CB
SHA-512:	1F592504F6FE80EB5781D5AB67647EAB7E1B50470E202C689B309D4F97854165BB02484F91DD133C5A05F1846F4EC1F9406053741B2459E6160946AEB92D2056
Malicious:	false
Preview:	(...qf..oy retne.........................VE>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\4b935e02-f04e-4dd8-9236-bcac997cd382\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:sZIAR0EPTn:syA9PTn
MD5:	9031118A3711AD9F5C4039735BB26E1C
SHA1:	21420EB4217B8F9276E692E36EAB465E938980D9
SHA-256:	23342A92402D371B6AFD11D2014F9BC85F5589DB64A6F5476F4BD288BE24C9CB
SHA-512:	1F592504F6FE80EB5781D5AB67647EAB7E1B50470E202C689B309D4F97854165BB02484F91DD133C5A05F1846F4EC1F9406053741B2459E6160946AEB92D2056
Malicious:	false
Preview:	(...qf..oy retne.........................VE>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\5f6b05dd-385e-4ad0-aad3-402004d8fb4f\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\5f6b05dd-385e-4ad0-aad3-402004d8fb4f\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:iGQaEO8gbu:iv16u
MD5:	683EDCF20C8C96CFB938241E263E21BE
SHA1:	4A6068D563E3DC4FD7F4475BBD57A8DB26551AF1
SHA-256:	2886DFF75F7FB2AC9DFEFAE3DD73DC12CC1DEBEDD2F32C430D710AB14509AC8B
SHA-512:	3BC436ED87B9089C4E43A9E224C44CD98230F2531A8E9665E6E58F64019D0DF5AB06356E31A2175EC31E443C0F35511094D716B430CF6AF05BA90D7D860C74BF
Malicious:	false
Preview:	(....c..oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\5f6b05dd-385e-4ad0-aad3-402004d8fb4f\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:iGQaEO8gbu:iv16u
MD5:	683EDCF20C8C96CFB938241E263E21BE
SHA1:	4A6068D563E3DC4FD7F4475BBD57A8DB26551AF1
SHA-256:	2886DFF75F7FB2AC9DFEFAE3DD73DC12CC1DEBEDD2F32C430D710AB14509AC8B
SHA-512:	3BC436ED87B9089C4E43A9E224C44CD98230F2531A8E9665E6E58F64019D0DF5AB06356E31A2175EC31E443C0F35511094D716B430CF6AF05BA90D7D860C74BF
Malicious:	false
Preview:	(....c..oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\6bdb3c4a-b6a8-40fb-9298-5957f7e38840\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\6bdb3c4a-b6a8-40fb-9298-5957f7e38840\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:9BmR0E613n:q9e3n
MD5:	CBF01CCB6913C0CE7179EBF658C80C48
SHA1:	0BC750311869704A7CB6C8F56DF89E3C5155DF85
SHA-256:	34550BBDF98D8E7C663FB6895B47B7E4F9520A7EAB636C3FBDDB7361C264EA80
SHA-512:	B42B41A2171B5A872EDAA454673E21DBC1C40769A0A1B3EEA4C96B011157B849A92DBE01C6E5618FD4E4666F64825EF9171D10564074BC36DE9137816716F9CD
Malicious:	false
Preview:	(.......oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\6bdb3c4a-b6a8-40fb-9298-5957f7e38840\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:9BmR0E613n:q9e3n
MD5:	CBF01CCB6913C0CE7179EBF658C80C48
SHA1:	0BC750311869704A7CB6C8F56DF89E3C5155DF85
SHA-256:	34550BBDF98D8E7C663FB6895B47B7E4F9520A7EAB636C3FBDDB7361C264EA80
SHA-512:	B42B41A2171B5A872EDAA454673E21DBC1C40769A0A1B3EEA4C96B011157B849A92DBE01C6E5618FD4E4666F64825EF9171D10564074BC36DE9137816716F9CD
Malicious:	false
Preview:	(.......oy retne..........................E>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\2a2b7cbbc61290b4_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.947207578017212
Encrypted:	false
SSDEEP:	6:mFOY7QuuJx7Q99SCt4b32H7zdUdw2MG7l0pFDU9LATj:wOY7QLQ99FmbuzSdw2bl0pYL
MD5:	03C9552568747B57B7C86D6AB33F29A4
SHA1:	AEAF8DBFEF530F2C47D440F49EA227C2C3E27234
SHA-256:	DEDA0FE9F40A1CC1345A3ABE794E2838C9DFA217D02DCB3CFD60E405BE7D5A93
SHA-512:	E47146222CE0A9BB8E03AC5BF813F7A15042AB8A848B979FED022F5F29497EA42856AF0426E122746329435B0373C50DF01B1782A6A94A5379A7D1BC7E22ACA3
Malicious:	false
Preview:	0\r..m......c....W......https://_user_prefs_key_store_.whatsapp.com/wa_web_user_prefs_cache_store_WAWebColumnPackingEnabledfalse.A..Eo......0h.+............GET.Y......." ..content-type..application/json0.......P.Z.unknown`.j.application/jsonx.............<.....,....y...>.,...H....?4.A..Eo......-...k.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\6ea66fa5b36b4157_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	6.225098454780609
Encrypted:	false
SSDEEP:	6:mWY7QuuJx7Q99vVUGaUNj6XG0tYb32H7hvzw2MG7lOOoCY4lz:FY7QLQ99tUJUNeXG0+bu5zw2bloCY45
MD5:	B2C7AB87FA305975F3222B585CE09729
SHA1:	849C8DD68B8E827AD49F4DD1635CBAA181269F52
SHA-256:	E785B2D5E212D39314ACD5AF00DFBFA0C9EF3C8131B3E0BEB7530B82509B2F73
SHA-512:	652AFD4851EE1434E0B0AAE7D6E9BD49A910988FEED89BEEBDDE784896EBD892AD450C5740FF6EEC2A5C4A592C717A188CCFF08462BD28C418E593E3A9E26920
Malicious:	false
Preview:	0\r..m......W....;.i....https://_user_prefs_key_store_.whatsapp.com/wa_web_user_prefs_cache_store_WANoiseInfoIv["xVMbiSysLyfHDqafBUaHXw==","E1b19OJqDKE6ZkWQ29m9/g==","HavMdPnPckJMua2ktJ9Mgw=="].A..Eo......Se..R...........GET.Y......." ..content-type..application/json0.......P.Z.unknown`.j.application/jsonx...............-J...g .xZ..^....9..m.....CQP...A..Eo.......0Z4k.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\92172a9e586cee2a_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	474
Entropy (8bit):	6.419930136966394
Encrypted:	false
SSDEEP:	12:oY7QLQ99/mfhHaqTuSASvU/Dbuf5sw2blPB:oQAw/QaIvU/Gfiw2blPB
MD5:	C5B1141A672509AF6EB1D1EABC78054E
SHA1:	E2D514DA686E96042925E5290355180E8D34174B
SHA-256:	7D11C39D03F5B7AC1676C01DC80EBAA986460F6028DADC0FB65E7AB92C6BB133
SHA-512:	849BF12718BF3489CB9FD4ACE76E88BD132B05088181E1740CE84FF3845C70C439ABA13DBBCD73DA15B33909C3BC1CB346AC8611E7A47D9DB18851A9A46B5EFF
Malicious:	false
Preview:	0\r..m......Y......R....https://_user_prefs_key_store_.whatsapp.com/wa_web_user_prefs_cache_store_WAWebEncKeySalt"G0L8qmIZCmSi+jfHNISAcz8glal/meH4AYvtsliJM6FT1kRNqwMGq9O4VUm0X1xIDjSxQDDERVZpvuuNOEolklrN6TB20cT3Xa3vF59zvvLylMlAeXDoiFmuXXRFf0mO6Qh59qIH+Ag6RJ5dxFqVYV2TBtwwSrP1m1juGjhtM2E=".A..Eo......f...............GET.Y......." ..content-type..application/json0......P.Z.unknown`.j.application/jsonx..............3.N..ef.....>.C..T.1....gh.. .A..Eo......~~.^k.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\e6039a61e4d2a504_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	6.347293925512858
Encrypted:	false
SSDEEP:	12:/Y7QLQ99vdHn3bHWvdI4SRvIbrrPJlcDbunFw2blNn:/QAwvdHYvPPPnFw2blNn
MD5:	DE9B6F60A99F7CA4AF69C67B61D9AD36
SHA1:	BF00767D4F54A0562D6B6510F62130906357DDFE
SHA-256:	81F6E8F27476897074504EEFEE684B062C6BA1BC770BF00E529D52059B3E2C70
SHA-512:	27692ED868CB717D12E5BCACD26BD8581B05E5A40F062CF7B185AC69ABF63B8043DC9EA1D7A1C04BB4844E3B75CBC7D77D6389622BB1143ADFDDBDD9BEB7EF7B
Malicious:	false
Preview:	0\r..m......U...Z.......https://_user_prefs_key_store_.whatsapp.com/wa_web_user_prefs_cache_store_WANoiseInfo{"privKey":"TiRXUVz8CeRNA5gGpmURmMlgMrJhYcsxFhNaGbUwdHdod/KslmxX2KSBGT4xT440","pubKey":"wAdJZ3ff8OnvIkFw8zlyLp6lvJkPkm+ago+7sqFMxcQynmLodExooiNPDP22O87L","recoveryToken":"R9A5G4+wqmVArnv6T/Q5LkmySfj+J2coZBVbnve3now="}.A..Eo......%.,.............GET.Y......." ..content-type..application/json0......P.Z.unknown`.j.application/jsonx.................!I...o....#ln.z.f..6&.xA...NH.A..Eo.......Q.3k.......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.4052112822229397
Encrypted:	false
SSDEEP:	3:blFNT4l/llBl0sv6SXl//NxX/YlXBp:hsflXjx6p
MD5:	D1D766B25251B3CF31E999254F5A2DD5
SHA1:	ECAC3E8B893E03FA50B52BD2F4A83906731AF937
SHA-256:	4730CFB611D204772095612032B35CB70176C86E8DB212984CACE2C526E13A68
SHA-512:	17112DCC9CB5B1BC36EC3511C0103E1C09F8786B95B8D0A8CE5CAC4B078F73C328055D42334E2FE2FB1B522CBFE180B0C5D80E3D9437BD9B0055489A4D141108
Malicious:	false
Preview:	.....@..oy retne............................a......................\|+................WAk..o.n.................lX.*...................".>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.4052112822229397
Encrypted:	false
SSDEEP:	3:blFNT4l/llBl0sv6SXl//NxX/YlXBp:hsflXjx6p
MD5:	D1D766B25251B3CF31E999254F5A2DD5
SHA1:	ECAC3E8B893E03FA50B52BD2F4A83906731AF937
SHA-256:	4730CFB611D204772095612032B35CB70176C86E8DB212984CACE2C526E13A68
SHA-512:	17112DCC9CB5B1BC36EC3511C0103E1C09F8786B95B8D0A8CE5CAC4B078F73C328055D42334E2FE2FB1B522CBFE180B0C5D80E3D9437BD9B0055489A4D141108
Malicious:	false
Preview:	.....@..oy retne............................a......................\|+................WAk..o.n.................lX.*...................".>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\d4ff028a-0af2-4a75-b7c4-c2e63a63f198\index-dir\the-real-index~RF624c00.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.4052112822229397
Encrypted:	false
SSDEEP:	3:blFNT4l/llBl0sv6SXl//NxX/YlXBp:hsflXjx6p
MD5:	D1D766B25251B3CF31E999254F5A2DD5
SHA1:	ECAC3E8B893E03FA50B52BD2F4A83906731AF937
SHA-256:	4730CFB611D204772095612032B35CB70176C86E8DB212984CACE2C526E13A68
SHA-512:	17112DCC9CB5B1BC36EC3511C0103E1C09F8786B95B8D0A8CE5CAC4B078F73C328055D42334E2FE2FB1B522CBFE180B0C5D80E3D9437BD9B0055489A4D141108
Malicious:	false
Preview:	.....@..oy retne............................a......................\|+................WAk..o.n.................lX.*...................".>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	modified
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RF61ee21.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RF61ee30.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RF61ee40.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RF61ef0b.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RF624c10.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.161003292480767
Encrypted:	false
SSDEEP:	6:YZTWssoitwWnKQRIRtBfQNjVp+S0JhyEbOxMBf67Q99S1zfEp4YRiC4YRigk:YZysbi6WnKQurBYNX+S0TyaR9iQ99S9X
MD5:	E204D2447EEF82266E818A9314BC0EF5
SHA1:	7B0480A05B51841DB2D2948AE9CC777EA297AC66
SHA-256:	D3E0741A922662953FFB3ABA27D4FC47EAE032D0D4F5831A8EFAF5DCB1FBC23E
SHA-512:	49F0E5FA45AEA4E214DAA7FCBDF87520C4056D5CDC7AA1735630EFF131367FB001120576295CC4B7AA376470A64468A37C59CE5325262EC5AE0231EFF75813E1
Malicious:	false
Preview:	.9..wa-stickers.$5f6b05dd-385e-4ad0-aad3-402004d8fb4f..(.0..3..wa-pp.$4b935e02-f04e-4dd8-9236-bcac997cd382..(.0..8..wa2.2410.1.$4061fcf7-5349-4f87-9296-9386dcb837bf..(.0..7..wa-assets.$6bdb3c4a-b6a8-40fb-9298-5957f7e38840..(.0..L..wa_web_user_prefs_cache_store.$d4ff028a-0af2-4a75-b7c4-c2e63a63f198...(.0...https://web.whatsapp.com/..https://web.whatsapp.com/ .(.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	957
Entropy (8bit):	6.078562717585031
Encrypted:	false
SSDEEP:	24:F2xc5NmvcncmB/24uTbDdiZIaO7JXbGPZ9OW4uTbjfZIaO78:F2emQJ2zTbBiZIhXbU4WzTbjZIk
MD5:	8C5EBAE3216068F6299EB3B005515AF7
SHA1:	2E412053740B6A9B2AAB1465784BE3A951BA779C
SHA-256:	0966D83ACEE76E5FCD0CEBF55897F05CAD601C89D6B61FED04795918D8B41ED3
SHA-512:	28E7F90996774A9A6951877A3A863C623FEBD9DF6ED6718BFE5CE66FEE921D1C5D9255251224034A4885EF08012788C97AE4F02BE02CAE3FBE2E1B08651A6E15
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...E................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.0INITDATA_UNIQUE_ORIGIN:https://web.whatsapp.com/...REG:https://web.whatsapp.com/.0......https://web.whatsapp.com/.)https://web.whatsapp.com/serviceworker.js .(.0.8.......@....Z.b.....trueh.h.h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..p.x...................coep_report.................REGID_TO_ORIGIN:0.https://web.whatsapp.com/..RES:0.0t...)https://web.whatsapp.com/serviceworker.js....."@A46A03CEDCC77EFEBCA03C3D14E4E5F5FD67FCCC91B94271C8321A67A81C8CDF..URES:0..PRES:0Ru...................REG:https://web.whatsapp.com/.0......https://web.whatsapp.com/.)https://web.whatsapp.com/serviceworker.js .(.0.8.......@....Z.b.....trueh.h.h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..p.x...................coep_report...............

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2187723641426
Encrypted:	false
SSDEEP:	6:FpHFRq1wknaZ5KrWLYQV+df/a252KLlvpHgyq2PwknaZ5KrWLYQV+df/a2ZIFUv:xbrHUdnxLRvYrHUdnJ2FUv
MD5:	3422923FC16F7AB2C50410AE26A4C33F
SHA1:	E3649CD59E02FE8E010C4CAB2CB2151CA74C2AB1
SHA-256:	B9B33342E4787A0A73067E5283F8D4E769DF0B8CC7F5967FDFB80672C3F56A97
SHA-512:	9E86D18ABDCB0F5C857EFCCC17E76E6B151895FF8E1A0CA418E769769138382C6974C151D60C6154F1441F570D9B2ED20E1A30BFF5E54A9D84210EE4AA902EC6
Malicious:	false
Preview:	2024/03/10-17:31:36.062 1990 Creating DB C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database since it was missing..2024/03/10-17:31:36.129 1990 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	3449417
Entropy (8bit):	5.674569443051517
Encrypted:	false
SSDEEP:	49152:R39IgYL0D6hSmvPZoOhimPp86D7b0tGPS3Bo1NjBfc33LcN6IdbcvodvPEneboJd:R39JYL0DolaD
MD5:	0C015DA9E3278625412AABC5B0440578
SHA1:	5CAAB49E70EB9ADA89C63A5515DD2234D35AA3CB
SHA-256:	852F9D79DCBBC39E8ABE6236381EE46906337F0EFF34ADF3120B6ECDE457F1DA
SHA-512:	4A34A84A344764F3DB1937BC476C75D244D99C9580D25C5536C7F69EF5B02C2760384458ED118E3F767953DBF5E46F6767A92E9BCA57D5E58D8FD4B446388CE7
Malicious:	false
Preview:	0\r..m..........rSG.....0/! Copyright (c) 2024 WhatsApp Inc. All Rights Reserved. /(()=>{var __webpack_modules__={14462:(e,t,n)=>{!function(e){"use strict";var t=function(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;t++)n[t]=e[t];return n},r=function(){throw new Error("no PRNG")},i=new Uint8Array(16),o=new Uint8Array(32);o[0]=9;var a=t(),s=t([1]),l=t([56129,1]),u=t([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),c=t([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),d=t([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),p=t([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),f=t([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function _(e,t,n,r){e[t]=n>>24&255,e[t+1]=n>>16&255,e[t+2]=n>>8&255,e[t+3]=255&n,e[t+4]=r>>24&255,e[t+5]=r>>16&255,e[t+6]=r>

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	6548745
Entropy (8bit):	6.259026656383427
Encrypted:	false
SSDEEP:	49152:M3iVJgFKR+lxT+TUsrShSkdMX1naGzUxmSPy6GZFC1kz8jKxSX4OskvnGEAjgcAv:MyFRtaGnPmrZ
MD5:	44F42405A0D4448F2F3E7797621DC7C3
SHA1:	A2CB5B90CD0E1E3C36C725DC8262CD24F30F097A
SHA-256:	1AB280AE8B018CB1D77B0C88F9FAA3EE79356F945D289E925F860DB286D8AEEE
SHA-512:	4AEFBB1202DAAA6B1360C4B49D1E9CC59C4169F643E58A8CCF2C317DA3AD787A5F0EF7104993D6154BC5B71F49F5111A490119EE545D586E0C53CB50981B17FD
Malicious:	false
Preview:	0\r..m..........rSG.....0....X..................;.u4......c......,T.,..`......L`.....,T.M..`TF...e.L`.....TSb............. RfR..\....__webpack_modules__..$Rg."......__webpack_module_cache__..Re>=<V....leafPrototypes....RcR.jb....getProto. Rf.\.*....__webpack_require__.. Rf..5....__webpack_exports__.e........................I`....Daz.....h..,T.t.`......L`......Rc........exports..$..a...........C..Rc........loaded..H.@...a...........RI..H....4KkX........(.`...\. ...d.....t.h.....0.K.........w@................/....-.......}......3.....4.........../...-....-....-..........\.....2...-.....(Sb............,`....Dab.h.0.h.......e..........0.`............H......8Q.4..d-)...https://web.whatsapp.com/serviceworker.js...a........Db............D`.........A.`............,T.X..`n.....L`.....0Sb.............1.`$.....Rc........14462...`....Da..........,T....`.......L`D....Q.Sb....................1......q......q..........q...........1...q...q...................q...1..........1..........q

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Psu00Xl/lllHlxEPBllt3liU+:UujIPBlop
MD5:	6712F45BCD07EDB6A92C58D2C05B44C5
SHA1:	3D70763AE4C8E5F5E813ADF666671330DD7EFA36
SHA-256:	5A06E76C1B9E98F45E8296AF5E3970BB3FC93FA1DEE5D58910B4CE37349D2F28
SHA-512:	8C88AEFCE48D0C0C95E7FC85C144BA264CA6E8879914A973F1169CFC9EA24D328FA85D9A5FFFB308EB74543DD42BA929FE38544915AC3B208B04202E093C7548
Malicious:	false
Preview:	@....wb.oy retne.........................X....,d$................K>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Psu00Xl/lllHlxEPBllt3liU+:UujIPBlop
MD5:	6712F45BCD07EDB6A92C58D2C05B44C5
SHA1:	3D70763AE4C8E5F5E813ADF666671330DD7EFA36
SHA-256:	5A06E76C1B9E98F45E8296AF5E3970BB3FC93FA1DEE5D58910B4CE37349D2F28
SHA-512:	8C88AEFCE48D0C0C95E7FC85C144BA264CA6E8879914A973F1169CFC9EA24D328FA85D9A5FFFB308EB74543DD42BA929FE38544915AC3B208B04202E093C7548
Malicious:	false
Preview:	@....wb.oy retne.........................X....,d$................K>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF623e54.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Psu00Xl/lllHlxEPBllt3liU+:UujIPBlop
MD5:	6712F45BCD07EDB6A92C58D2C05B44C5
SHA1:	3D70763AE4C8E5F5E813ADF666671330DD7EFA36
SHA-256:	5A06E76C1B9E98F45E8296AF5E3970BB3FC93FA1DEE5D58910B4CE37349D2F28
SHA-512:	8C88AEFCE48D0C0C95E7FC85C144BA264CA6E8879914A973F1169CFC9EA24D328FA85D9A5FFFB308EB74543DD42BA929FE38544915AC3B208B04202E093C7548
Malicious:	false
Preview:	@....wb.oy retne.........................X....,d$................K>.q/.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	modified
Size (bytes):	273
Entropy (8bit):	4.63778242956347
Encrypted:	false
SSDEEP:	6:S85aEFljljlnlaDaOBB1KcwgPSRiT2cN/14E+B2ORI:S+a8ljljlnNOBvFP8K2WqD2ORI
MD5:	7D92E08A1BB0C589B232CC9F8FAD34BD
SHA1:	9E0D2EEC04F8C695340663603CEC5B6467391453
SHA-256:	7397BB64D68AD1D051C55067848C775CCEC1AFB38EE1FDAE0CCEFBFC22B718EF
SHA-512:	2759A2983F99A56B469ABC0A7791FFC7E80B8D0CF6268CD6F05A4947512552E5CF9A9C7BF7B77C62EF6EB760914BE3DEA8186214E1C064D75618F2492A47880E
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f...............2...g................next-map-id.1.Hnamespace-10d925f5_176b_4174_af39_8256792926c8-https://web.whatsapp.com/.0).i.9................map-0-storage_test.s.t.o.r.a.g.e._.t.e.s.t.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.260161100907398
Encrypted:	false
SSDEEP:	6:Fr9c1L+q2PwknaZ5KrWLYQV+dWQMxIFUt88r3WEQGNjKWZmw+8r3Y1LVkwOwkna/:Z61L+vYrHUdHFUt8e3WE52W/+e3Y1LV/
MD5:	BDF2B3243BE067D08FE759BC6A6723DE
SHA1:	C19B1A2C0896342A7D1D2ADE498F6178FC58D94B
SHA-256:	6DBEBC256B3C859BB5617E9FD4CD7B86CA8CCF6F615C0BEC76991656D018F880
SHA-512:	2F8CE510742D6786BE022403C7197243AFCC56928F0544D4AE074294C0D08D0D672F1FCE72A5DCC1BBBFED9D85ED9ED42D3F8A1786C961CE3EBF54F2314E8ED5
Malicious:	false
Preview:	2024/03/10-17:31:19.303 b5c Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage/MANIFEST-000001.2024/03/10-17:31:19.933 b5c Recovering log #3.2024/03/10-17:31:19.943 b5c Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.260161100907398
Encrypted:	false
SSDEEP:	6:Fr9c1L+q2PwknaZ5KrWLYQV+dWQMxIFUt88r3WEQGNjKWZmw+8r3Y1LVkwOwkna/:Z61L+vYrHUdHFUt8e3WE52W/+e3Y1LV/
MD5:	BDF2B3243BE067D08FE759BC6A6723DE
SHA1:	C19B1A2C0896342A7D1D2ADE498F6178FC58D94B
SHA-256:	6DBEBC256B3C859BB5617E9FD4CD7B86CA8CCF6F615C0BEC76991656D018F880
SHA-512:	2F8CE510742D6786BE022403C7197243AFCC56928F0544D4AE074294C0D08D0D672F1FCE72A5DCC1BBBFED9D85ED9ED42D3F8A1786C961CE3EBF54F2314E8ED5
Malicious:	false
Preview:	2024/03/10-17:31:19.303 b5c Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage/MANIFEST-000001.2024/03/10-17:31:19.933 b5c Recovering log #3.2024/03/10-17:31:19.943 b5c Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Session Storage\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.267385140532919
Encrypted:	false
SSDEEP:	6:FrjcM+q2PwknaZ5KrWLYQV+dUUh2ghZIFUt88rbJZmw+8rhvcMVkwOwknaZ5KrWq:ZgM+vYrHUdrhHh2FUt8eN/+eWMV5JrHs
MD5:	6015FA88F167F9384E501695E9120816
SHA1:	E89ACD6B6DE9782B564C65A91E5FB2B2C98B98B7
SHA-256:	B5C31D9073C4A372A87AC03B28416AB6396B9CEDCABEAB339E0EC67A6FD72172
SHA-512:	2570650B11585EE70572C4AA67C43382B6A0FFD7B896638C451323D3C72785B7159068C5F2CAC0514CF32E64ED509541CE351C20337A1D269DAA90F306F6C673
Malicious:	false
Preview:	2024/03/10-17:31:17.525 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database/MANIFEST-000001.2024/03/10-17:31:17.561 19fc Recovering log #3.2024/03/10-17:31:17.563 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.267385140532919
Encrypted:	false
SSDEEP:	6:FrjcM+q2PwknaZ5KrWLYQV+dUUh2ghZIFUt88rbJZmw+8rhvcMVkwOwknaZ5KrWq:ZgM+vYrHUdrhHh2FUt8eN/+eWMV5JrHs
MD5:	6015FA88F167F9384E501695E9120816
SHA1:	E89ACD6B6DE9782B564C65A91E5FB2B2C98B98B7
SHA-256:	B5C31D9073C4A372A87AC03B28416AB6396B9CEDCABEAB339E0EC67A6FD72172
SHA-512:	2570650B11585EE70572C4AA67C43382B6A0FFD7B896638C451323D3C72785B7159068C5F2CAC0514CF32E64ED509541CE351C20337A1D269DAA90F306F6C673
Malicious:	false
Preview:	2024/03/10-17:31:17.525 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database/MANIFEST-000001.2024/03/10-17:31:17.561 19fc Recovering log #3.2024/03/10-17:31:17.563 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.350206916118494
Encrypted:	false
SSDEEP:	6:FrYIq2PwknaZ5KrWLYQV+dWIFUt88rCCZmw+8rvZFkwOwknaZ5KrWLYQV+dv/WLJ:Z5vYrHUdPFUt8eCC/+ef5JrHUdvUJ
MD5:	B925844D5CC4DCD577D294BE224CDBC4
SHA1:	26E53C27C678AD4F2A2C340D57AF7845816825CC
SHA-256:	53FC1A5011BBF225F77E2A15EA95E95C7C5692EC98F236A6887EC8B0A35E9C74
SHA-512:	80BAF6780CFDB92B3FB72167C7B1FFEB7065736F1CA62D10E21AC7C67C249872C525E26EB5890E1B9098276D20F86C9B74B67AB90CF664911E9A150CC338CA83
Malicious:	false
Preview:	2024/03/10-17:31:18.296 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/10-17:31:18.587 1960 Recovering log #3.2024/03/10-17:31:18.592 1960 Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.350206916118494
Encrypted:	false
SSDEEP:	6:FrYIq2PwknaZ5KrWLYQV+dWIFUt88rCCZmw+8rvZFkwOwknaZ5KrWLYQV+dv/WLJ:Z5vYrHUdPFUt8eCC/+ef5JrHUdvUJ
MD5:	B925844D5CC4DCD577D294BE224CDBC4
SHA1:	26E53C27C678AD4F2A2C340D57AF7845816825CC
SHA-256:	53FC1A5011BBF225F77E2A15EA95E95C7C5692EC98F236A6887EC8B0A35E9C74
SHA-512:	80BAF6780CFDB92B3FB72167C7B1FFEB7065736F1CA62D10E21AC7C67C249872C525E26EB5890E1B9098276D20F86C9B74B67AB90CF664911E9A150CC338CA83
Malicious:	false
Preview:	2024/03/10-17:31:18.296 1960 Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/10-17:31:18.587 1960 Recovering log #3.2024/03/10-17:31:18.592 1960 Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Top Sites

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Visited Links

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033769341339387224
Encrypted:	false
SSDEEP:	3:ImtVuMrQ9Igrlll:IiVuME9n/l
MD5:	73BEA001EDC64D57237BBFBBA2A97C4A
SHA1:	DF9C09F667F8670E60EAFF854AD80E06AAE52686
SHA-256:	63D39E580EC5F811E8D93DC9DE4285EAB174C04CB0CA4D15F79DB4BDB7C9CCF8
SHA-512:	033276F05E67F82D04646009913E20904FA63049B5AA4FC366EF6853248A2347AD039C99F96097A317138503C1E26185A9A96CF55BBED5AFAC31BD9F272F38A6
Malicious:	false
Preview:	VLnk.....?......3\.*...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\Web Data

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9328735337338357
Encrypted:	false
SSDEEP:	192:h2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:h2qOB1nxCkvSAELyKOMq+c
MD5:	1CB76F630E428DE01087C25758DCB804
SHA1:	09AE3969DD5FBFCB081D970D6FD2DC3C172DE5E7
SHA-256:	7A721C305AB19AFFD79432DC3112F9DC2E7F593987B0941387B9AE3C61A39ED3
SHA-512:	03DA43E7DCE73A4753F60F1F224FCE79A3F531DA412E95736631913836325114AA9BA4FD301E8C830CE8EAC513879FF22694A24BE7B4D426658653C828A97685
Malicious:	false
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\WebStorage\QuotaManager

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.47200910754358677
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBSRAH4v:v7doKsKuKZKlZNmu46yjxY
MD5:	E4AF1B0C4AAF22F6DEBF09B35EB31442
SHA1:	836A058652354990FD3165BF1273CB8E541C5B0A
SHA-256:	5CB57B41E40C59B0B17E79ABF9B247AF2383CD431EB88A79877EF2AA6BF9133D
SHA-512:	ABB45EE285B0590F7FDFB45855933A392755CE430C491BB85604469BA42264D369AF4BF53F9F1E3BFC6BCFCC0656099B89B163684F0CA57FCB518A6DF6C7A619
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\databases\Databases.db

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\heavy_ad_intervention_opt_out.db

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1416
Entropy (8bit):	5.408212673381656
Encrypted:	false
SSDEEP:	24:g887SBSAX/o/HPZWJHRHMIIit2YKIt2YKl3KcMQNkQCMYKIMYKkyPAlkfAlkF3:g887SBSaQ/PqHRHMxiIYjIYszMqkdMYO
MD5:	F2CC4DB48ED2B9FD9AABDF08A8E43E7C
SHA1:	FA44F88F20B2A93E04F1DA2170527E97E06A4446
SHA-256:	87CA1349B0EC213F6815EE445066E3F8DFE30534A71E277F9EFC3BB9BBB554FD
SHA-512:	E8404777427448F8CF84618D7B608DEE18495A9B120C354B1201CACF266E0FA98856A6628C0A7FF706C410A9F7BD79386E3F52CF5B87EC5C2CC22A4683E27C9E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............Y<.B.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch.....4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo.....4_IPH_GMCCastStartStop...IPH_GMCCastStartStop.....4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode.....4_IPH_LiveCaption...IPH_LiveCaption.....4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage...."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature.....4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.381713394874629
Encrypted:	false
SSDEEP:	6:FrsvcM+q2PwknaZ5KrWLYQV+d4rK+IFUt88reNJZmw+8rEccMVkwOwknaZ5KrWLL:Zs0M+vYrHUd53FUt8eeX/+eiMV5JrHUA
MD5:	73FC05B2D36D318A103C93F594BEEE80
SHA1:	C22B3394D6236DDE2A7F717FDBEA6235534707AF
SHA-256:	72BB23D96A1CE827096F134546DE751CABF06DFA188FC992EF20DEC0DBC7E31C
SHA-512:	92D4CD3944DF26D663BCC528DC044A4B5FBA67BA2F818F22D47D2CB852AF05F000338CC2938AF3F142111BF182AF59E13D9CC45331C606CBFE7DBB5D134FBE47
Malicious:	false
Preview:	2024/03/10-17:31:17.849 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db/MANIFEST-000001.2024/03/10-17:31:17.865 19fc Recovering log #3.2024/03/10-17:31:17.866 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.381713394874629
Encrypted:	false
SSDEEP:	6:FrsvcM+q2PwknaZ5KrWLYQV+d4rK+IFUt88reNJZmw+8rEccMVkwOwknaZ5KrWLL:Zs0M+vYrHUd53FUt8eeX/+eiMV5JrHUA
MD5:	73FC05B2D36D318A103C93F594BEEE80
SHA1:	C22B3394D6236DDE2A7F717FDBEA6235534707AF
SHA-256:	72BB23D96A1CE827096F134546DE751CABF06DFA188FC992EF20DEC0DBC7E31C
SHA-512:	92D4CD3944DF26D663BCC528DC044A4B5FBA67BA2F818F22D47D2CB852AF05F000338CC2938AF3F142111BF182AF59E13D9CC45331C606CBFE7DBB5D134FBE47
Malicious:	false
Preview:	2024/03/10-17:31:17.849 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db/MANIFEST-000001.2024/03/10-17:31:17.865 19fc Recovering log #3.2024/03/10-17:31:17.866 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\000003.log

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	3.975692584252663
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//73K5t/b8gMWlJhC+lvBXJSge9G:G0nYUtypL3K3bPvhC+lvBJ
MD5:	AEF39F37308240654CBCE40C92683259
SHA1:	2E1F0EDB7837EF070A3B0296A703A316470036F0
SHA-256:	431A499548049BA3A9133F4C3C8C545C6F03F56FE11F36ECD6BBE24D796F9665
SHA-512:	833061716FA13E926AE26069185FD93B5752314B6EC0D0C5E4D7EBE6FDEBCF6B243DF07638B16172DED476791071EBA2E162062BE2420FBEFB2592BE611C04FA
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.......KD.................__global... .X...................20_.....W.J+.................19_......qY.................18_.....5oP..................3_.......\4.................4_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_.....#..#.................3_..........................4_..........................9_.....3V.~.................9_.....

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\LOG

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	366
Entropy (8bit):	5.325613865885722
Encrypted:	false
SSDEEP:	6:FrXuvcM+q2PwknaZ5KrWLYQV+d4rzAdIFUt88rPNJZmw+8rIYcMVkwOwknaZ5KrR:ZXu0M+vYrHUduFUt8ePX/+ewMV5JrHUh
MD5:	BE31D22C17046C75ED47F78806AE546E
SHA1:	415F5395CD54D295C94AC24132D88081B8227D0F
SHA-256:	DDB20ADC418B68D8CA9C60B732B3E9F5C84FC2FAA0D789864BFECFDA980F8E9B
SHA-512:	AB04C1533CEFC85EF14EDE36281CFD4C1FCBDE3419A29F05909373CFA91BC93954DC5DEE9E3C88C871349B9E29A3DC576D724F7AD26D150C5FB4719A9A416DAA
Malicious:	false
Preview:	2024/03/10-17:31:17.766 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata/MANIFEST-000001.2024/03/10-17:31:17.817 19fc Recovering log #3.2024/03/10-17:31:17.819 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	366
Entropy (8bit):	5.325613865885722
Encrypted:	false
SSDEEP:	6:FrXuvcM+q2PwknaZ5KrWLYQV+d4rzAdIFUt88rPNJZmw+8rIYcMVkwOwknaZ5KrR:ZXu0M+vYrHUduFUt8ePX/+ewMV5JrHUh
MD5:	BE31D22C17046C75ED47F78806AE546E
SHA1:	415F5395CD54D295C94AC24132D88081B8227D0F
SHA-256:	DDB20ADC418B68D8CA9C60B732B3E9F5C84FC2FAA0D789864BFECFDA980F8E9B
SHA-512:	AB04C1533CEFC85EF14EDE36281CFD4C1FCBDE3419A29F05909373CFA91BC93954DC5DEE9E3C88C871349B9E29A3DC576D724F7AD26D150C5FB4719A9A416DAA
Malicious:	false
Preview:	2024/03/10-17:31:17.766 19fc Reusing MANIFEST C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata/MANIFEST-000001.2024/03/10-17:31:17.817 19fc Recovering log #3.2024/03/10-17:31:17.819 19fc Reusing old log C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GrShaderCache\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GrShaderCache\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GrShaderCache\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GrShaderCache\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GrShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl/8Tl:Ls3Il
MD5:	6C479590C4A536BC19FA5DDBC3542176
SHA1:	A7C1D588A356F9B43705DE1D8D453EBBF1B75BBB
SHA-256:	2CB72379C5046E4926D20795DE50EF39DB9B878D106CA5B51C158CC806960BB6
SHA-512:	2362A793E85DB9AE418E67C77B7875EB3FADED2F7C708060A8F0DCEEBBA580FA16210469971BC9401C83FE194DBB77412A875B7BD2092D60211135975720F7CE
Malicious:	false
Preview:	........................................PG.<.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GraphiteDawnCache\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GraphiteDawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GraphiteDawnCache\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GraphiteDawnCache\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\GraphiteDawnCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl:Ls3
MD5:	51F30379089ABC142E8701E72C26D016
SHA1:	17333A5271CBD30943978F1BCECED3318D7A1A7D
SHA-256:	6FE539128F1CFBE62492FF65190C5F8751A034C62849BB7798666CC7A17A172B
SHA-512:	30E73D3DD1DA6A241CFA7A1706A7423922617CA119AD881446DABC0B4112828642C79E845C42DE997ADCD575EFFE7A9A147E0DE1B170E19B924E82C0DAF2ED74
Malicious:	false
Preview:	.........................................+.<.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Last Version

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF615963.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF615a7c.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF61674d.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF61911c.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF6195b0.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Local State~RF61bc82.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.6834948680070525
Encrypted:	false
SSDEEP:	24:YKWJu5rrtI+9nZLyUW83DUH6pBZfaeCUWO4czIbvX0QQRCYfYg:Yqfq6UULIHIB1ZH4czCvZB0
MD5:	5E498BB75009739104901BE011470B60
SHA1:	8AC02790BCEE6BC3237F00770A4754B8F2ACD759
SHA-256:	2E6E8FE1D79C2D35A40FBF69D9E3833AD501362527493BD859844E8D234B4206
SHA-512:	1A70A51CD440479905D5297AB77BE4FF2ADCFEB3E842242CB87461A3BC8507A46EE8A67A407B63163B1945EE26C8F76DBCC227F7736B90B8B28BCE2E6A165485
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85exQ1p8F3tiHZeLlUgFKxjH/+8sdYfhmQyk01nQ9+OcGqyrVCA=="},"uninstall_metrics":{"installation_date2":"1710088262"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3779,"pseudo_low_entropy_source":565,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13354561862731533","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\ShaderCache\data_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\ShaderCache\data_1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\ShaderCache\data_2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\ShaderCache\data_3

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\ShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlvV:Ls3v
MD5:	81498B908B4F1900990764EEA9EBAD94
SHA1:	45794D650D2014D8C96153B6DF2D05FEA1A8ED28
SHA-256:	EDA60939BA9EBA9F7F88C57428CCEACDAB135DE63B20635D6EDF3EDD7C7F99B1
SHA-512:	E78FE3FB2BD0A07663399D26D77BE7286F938026B8E1792C2426C8BACE1D860CF7410A5040E3B0D3D154C9EFF6F2F708F62F0FF14EF6510D2B7ED77562E49D8F
Malicious:	false
Preview:	........................................7Q.;.q/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\customSettings

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris_0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\edgeSettings

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\synchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\topTraffic

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\RemoteData\topTraffic_638004170464094982

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\local\uriCache

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\SmartScreen\local\uriCache_

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.992610248636751
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfcbUbAozRLuLgfGBkGAeekVy8Hfjg9PIAcnVUTLTy:YWLSGTcbOAo9LuLgfGBPAzkVj/EMn7
MD5:	362356862B7B75BF7C3AADBB57386BE6
SHA1:	13116ABF190371CE104DBFC2C8AD7B68FBC5BE56
SHA-256:	31E75E124D67810EEBE0E11A70450FB3FCE22D0BDB48D4D504FA53B2EF083AE3
SHA-512:	16FFF87E57F2F18C12C887595AFACED78D022BF668B1DEEC13059D96E47C94358B71376EF438EADD86D8E39D8564064DEB1DAAF2D13B5E49C68B36A9923BF670
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"a03546dcfafd8e0c","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":0,"expiration_time":1710195231952176}]}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Variations

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\b26c5473-dd8a-47b9-a723-937cff6f9c4b.tmp

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	5.255452687895151
Encrypted:	false
SSDEEP:	96:PNkGSCvfq6UU0Hg58rh/cIyURLl8DotomAB7oLZxJCisX4u:PNBSh6UhHZViDUO7Qr+
MD5:	C8BF6254FD82A3DD3F9B6C65481CAD88
SHA1:	81127A92D3DB28864A30D98794B283AAC5417CA6
SHA-256:	09110322F12898A794A6DF8021C002B23AA3CC6D0EC1AAB9643EB71504214758
SHA-512:	727AB1EEEE70DAC72B2054BD2575BFDBF4505BC9DE05888EF01D981AC5D8BBC5A7B6D9E8A65455431DCAE06344CAED03F84E3519CDA41F4337AD1677AC3B0251
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.710088264565288e+12,"network":1.710088264e+12,"ticks":6381188236.0,"uncertainty":2649480.0}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABgeMgLbTHqT4ZdtySMAHWvEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADlzDCh0OPky8yw7bsie0rKFKneHA/kx1kyF7EN3ed+cQAAAAAOgAAAAAIAACAAAABZDcy2+MV59fH/50Y/NbTYCxbv1ErctHXne9S5dCGYTTAAAAAo0dMALsmk9bPktOPAt7Qnm8i5+3YRs3o6oaUyfg/N8kkxL5Gr2eqBwQ/ahjcsFgRAAAAABZn0u/6sLNl/Ewtdq2E3cxyRTMl+UiEpnhu85ex

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Mar 10 15:30:42 2024, mtime=Sun Mar 10 15:30:42 2024, atime=Sun Mar 10 15:30:42 2024, length=56368, window=hide
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.050624845736761
Encrypted:	false
SSDEEP:	12:8YU9QC24NWCQgdY//77QSSLU37XfjAsyrHkfvBmV:8YIMi+PQSsgrAsyYfvBm
MD5:	BB4B04A57720B551A6597B3B9A632397
SHA1:	9A63D0183103100601519155084E821271AB0AE2
SHA-256:	CA358EBB404AE499FDB2C27E7BC341FD2FA29B61F30395B543697331A9CD57A9
SHA-512:	E4023E96A633C225956A417CBD5AD73DA403BA178AA5E1C1E6FE361D44EE5C7737C3CCCAF1D14298BD9AE45A2598F9681865F8B7ECA299EA73E33CDC35B03729
Malicious:	false
Preview:	L..................F.... ...m.XK.s..m.XK.s..m.XK.s..0.......................v.:..DG..Yr?.D..U..k0.&...&......vk.v....\|C.0.s.....K.s......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^jX.............................%..A.p.p.D.a.t.a...B.V.1.....jX....Roaming.@......CW.^jX................................R.o.a.m.i.n.g.....b.2.0...jX. .XClient.exe.H......jX.jX.....`......................K..X.C.l.i.e.n.t...e.x.e.......Y...............-.......X............a.^.....C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......965543...........hT..CrF.f4... .q.T..b...,.......hT..CrF.f4... .q.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56368
Entropy (8bit):	6.120994357619221
Encrypted:	false
SSDEEP:	768:fF9E8FLLs2Zokf85d9PTV6Iq8Fnqf7P+WxqWKnz8DH:ffE6EkfOd9PT86dWvKgb
MD5:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
SHA1:	19DFD86294C4A525BA21C6AF77681B2A9BBECB55
SHA-256:	99A2C778C9A6486639D0AFF1A7D2D494C2B0DC4C7913EBCB7BFEA50A2F1D0B09
SHA-512:	94F0ACE37CAE77BE9935CF4FC8AAA94691343D3B38DE5E16C663B902C220BFF513CD02256C7AF2D815A23DD30439582DDBB0880009C76BBF36FF8FBC1A6DDC18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A>.]..............0................. ........@.. ....................................`.................................t...O.......................0B..........<................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......t3..pc.............X...<........................................0..........s.....Y.....(.....Z.....&..(......+....(....o......r...p(....-..r...p(....,.....X....i2..-;(....(..........%.r!..p.(....(....((...(....(....(....( .....-.(7...(......(....-...~S...-.~R....S...s!.....~W...o"....~U...o#....~V...o$....o%...~Y...o&...~S...~Q...~T....s'....P...~P...sE...o(............~W....@_,s.....()...r7..p.$(*........o+..........o,....2....... ....37(....(8.........%...o-....

C:\Users\user\Desktop\Bot Master.lnk

Process:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sun Mar 10 15:30:51 2024, mtime=Sun Mar 10 15:30:51 2024, atime=Mon Jun 26 09:50:00 2023, length=2941952, window=hide
Category:	dropped
Size (bytes):	2156
Entropy (8bit):	3.4567703664048017
Encrypted:	false
SSDEEP:	24:80VAEcbdOEefn9KYPIA0e97KdMdwdv7bIUUSvqyFm:80xcbdOTfgYH0JdMdwdfd6yF
MD5:	9670263686CB2B13F51C9C7A2E1D06CD
SHA1:	9801AB9CE6A215531139DD92FE97C61E3BDE86AE
SHA-256:	08FE2AD6C0C6E5C42853158AC57057F276D918DC2CEAB85A1E3BDE011D903D72
SHA-512:	2D8ECC5BD049F18B74511AC24A9A400C998739CEB95D7982EFE7BA266BB0124542A4382E73DD71C43688118A8CEA81FC9320D3605017F0880B49132E59A5B907
Malicious:	false
Preview:	L..................F.@.. ......P.s..os.P.s....F.......,..........................P.O. .:i.....+00.../C:\.....................1.....jX...PROGRA~2.........O.IjX.....................V.....U...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1.....jX...BOTMAS~1..F......jX.jX.....v.....................U...B.o.t. .M.a.s.t.e.r.....^.1.....jX...BOTMAS~1..F......jX.jX...........................B'..B.o.t. .M.a.s.t.e.r.....h.2...,..V@V .BOTMAS~1.EXE..L......jX.jX...............................B.o.t.M.a.s.t.e.r...e.x.e.......i...............-.......h............a.^.....C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe..@.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.B.o.t. .M.a.s.t.e.r.\.B.o.t. .M.a.s.t.e.r.\.B.o.t.M.a.s.t.e.r...e.x.e.-.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.B.o.t. .M.a.s.t.e.r.\.B.o.t. .M.a.s.t.e.r.\.:.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.B.o.t. .M.a.s.t.e.r.\.B.o.t. .M.a.s.t.e.r.\.B.o.t.M.a.s.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	221
Entropy (8bit):	4.801526423190794
Encrypted:	false
SSDEEP:	6:zx3Me21f1LRJIQtAMw/VgRZBXVN+1GFJqozrCib:zKpj1JIUwqBFN+1Q3b
MD5:	A3DCA41A950A7DF7ECE76A867A17400E
SHA1:	AA9EFDBCF37BEE2C7FD0986F1A4308A73EC3F7BB
SHA-256:	6B2BE177016DF867316A0C432DAB0B71B6E51B35D169B0ACB1ABB47A4C03D7C0
SHA-512:	F80207B5B78C7AE867AAB139196BBBEDE0437961DD03E790AEF3B877A228D7A90B9178B3342324B0EEA1C270E2A232A769B2F2D9E5DB4C065EB95140FA12239D
Malicious:	false
Preview:	Microsoft (R) ASP.NET Compilation Tool version 4.8.4084.0..Utility to precompile an ASP.NET application..Copyright (C) Microsoft Corporation. All rights reserved.....Run 'aspnet_compiler -?' for a list of valid options...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.939995431573425
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
File size:	3'511'296 bytes
MD5:	f24a4d5b6036a3de2eba88868bd771f2
SHA1:	3048d822d2b80d66284d1446052da0ba2be27d9e
SHA256:	2c2f38b6679224281d1f9a0bee4ac5db26f845e0d0eb74c0caa2d994411ee7e2
SHA512:	17a245a0c5e70982ea5f479319417864e122d3febbdf16d310d42b7f9acb8d7135fdf9c34082cd42858a4b98e696ec02d17b69deb249e8ed0cdfab26ec909bfc
SSDEEP:	49152:rbAa/I9L1n4OjdXalpe85gqWa4CRFaMQRh/7hK+OWp7W+qYp9foZWHyeHxYMp5FN:ga/K1Fa71qrMFO3DgCjqWQZWSmeMTPH
TLSH:	05F5230FFB8A89E1D2846B31C5EB593093B4E6817397CB4A358E53E518433A6FD5920F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.e..................4...........4.. ....5...@.. ........................5......J6...`................................

File Icon


Icon Hash:	1a696825b4888b03

Static PE Info

General

Entrypoint:	0x74fbde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65004EB5 [Tue Sep 12 11:42:45 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34fb90	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x350000	0xb306	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x34dbe4	0x34dc00	ecd177a9aacebcc289ba7f2a0311a5bf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x350000	0xb306	0xb400	80dc0e6606893da9072dbe53e7418202	False	0.5292100694444445	data	3.818194034187686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35c000	0xc	0x200	82b588a9fbfc65fe32d5cc876d2f8979	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x350234	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	0.3374277456647399
RT_ICON	0x35079c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	0.7161552346570397
RT_ICON	0x351044	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	0.6295309168443497
RT_ICON	0x351eec	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608	0.5874471086036671
RT_ICON	0x353514	0x2ca8	Device independent bitmap graphic, 96 x 192 x 8, image size 10368	0.5359517144856543
RT_ICON	0x3561bc	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 18432	0.5150287238407879
RT_GROUP_ICON	0x35ade4	0x5a	data	0.7555555555555555
RT_VERSION	0x35ae40	0x2dc	data	0.43579234972677594
RT_MANIFEST	0x35b11c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/10/24-17:32:22.814457	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49734	15762	192.168.2.4	209.25.140.212
03/10/24-17:32:24.712981	TCP	2852874	ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2	15762	49734	209.25.140.212	192.168.2.4
03/10/24-17:30:45.329887	TCP	2853192	ETPRO TROJAN Win32/XWorm V3 CnC Command - sendPlugin Outbound	49734	15762	192.168.2.4	209.25.140.212
03/10/24-17:32:24.712981	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	15762	49734	209.25.140.212	192.168.2.4
03/10/24-17:32:06.998086	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49734	15762	192.168.2.4	209.25.140.212

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2024 17:30:43.797106028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:44.011290073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:44.011507988 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:44.114499092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:44.469456911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:44.635490894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.021644115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.277770996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.277790070 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.277801037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.277858973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.322988987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.329886913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.526453018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.530184031 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.731178045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.731257915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965255022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965328932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965342045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965500116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965574980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965749979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965764046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965775967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965809107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965838909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965843916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965869904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.965904951 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.965905905 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.966398001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.967025042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.967052937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.967092037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.967097044 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.967137098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.967715979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.967762947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.968127012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.968167067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.968170881 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.968612909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.968657970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:45.968657970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.968704939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:45.968744993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.020760059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.020976067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.131690979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.304363012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.304653883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.317281961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.317847967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.317955017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.317995071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.318505049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.318542957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.318578959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.318661928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.318661928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.318685055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319046021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319102049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.319190025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319271088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319307089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319340944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.319350004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.319411039 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.320122004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.320194006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.320259094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.320364952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.320401907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.320456028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.321444035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.321484089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.321556091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.368496895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.369349003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.369452000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.664890051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.665585995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.665647984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.666129112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.666227102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.666294098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.668338060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.668500900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.668581963 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.668715000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.668925047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.668973923 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.669133902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669193029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669239044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.669508934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669600964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669641018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669650078 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.669744968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.669794083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.670001030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670249939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670300961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.670305014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670629025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670674086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.670736074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670751095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.670795918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.671112061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.672800064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.672883987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.673590899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.673649073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.673696041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.673893929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.673949957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.674005032 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.674542904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675136089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675189018 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.675194979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675260067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675307989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.675337076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675717115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.675767899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.676074982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.676408052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.676455021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.677018881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.717659950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.717713118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.718034029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.718775988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.718816042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:46.718849897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:46.760582924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.010869026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.012422085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.012516975 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.012573957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.013376951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.013432026 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.016751051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.017796993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.017854929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.018172026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018241882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018299103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.018383980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018484116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018538952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.018686056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018934965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.018991947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.019710064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020111084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020148993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020165920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.020369053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020428896 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.020648003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020687103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.020744085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.021194935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.021523952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.021580935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.021759987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.021809101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.021868944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.022283077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.022320986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.022376060 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.022723913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.022761106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.022831917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.024075985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024128914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024166107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024199963 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.024261951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024298906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024315119 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.024369955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024425983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.024918079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.024998903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.025034904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.025054932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.025078058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.025134087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.074121952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.079375029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.079489946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.428462982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.428530931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.428613901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.428977013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.429017067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.429081917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.429779053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.429876089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.429934025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.430039883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.430211067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.430280924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.430442095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.430529118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.430584908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.431515932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.431602001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.431663990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.431679010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.432038069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.432101965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.432173967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.432212114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.432272911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.432905912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.432946920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.433005095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.433228970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.433494091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.433561087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.433567047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.433643103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.433737993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.433923960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.434048891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.434087038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.434113979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.434345007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.434401989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.435069084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435167074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435225964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.435226917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435296059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435353041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.435353041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435630083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435667038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.435686111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.436144114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.436187029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.436204910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.436288118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.436343908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.436358929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.436491013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.436551094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.436568975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.437192917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.437249899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.437251091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.479322910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.773581982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.779340982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.779377937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.779432058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.779469013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.779618025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.780328035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780368090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780422926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.780477047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780514956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780575037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.780694962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780798912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.780855894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.782222033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.782289028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.782324076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:47.782344103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:47.823118925 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.127765894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.128736019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.128777981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.128835917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.128994942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.129034996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.129053116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.129074097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.129126072 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.129707098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.129755020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.129805088 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.130513906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.130950928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.131009102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.131052971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.131124973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.131175041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.131190062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.131910086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.131968021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.132168055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.132977962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.133016109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.133025885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.133265972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.133322954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.133697033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134149075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134186983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134203911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.134356976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134409904 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.134468079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134737015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134774923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.134789944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.135354042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.135396004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.135409117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.135435104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.135488033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.135504961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.135776043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.135828972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.135850906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.136869907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.136908054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.136923075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.137001038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137037992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137067080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.137125969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137162924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137176991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.137548923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137600899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.137607098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137645960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.137693882 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.138489962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.182373047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.478533030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.478590965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.478830099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.479012966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479120970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479163885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479202032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479216099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.479243040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479255915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.479285002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479327917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479350090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.479670048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.479715109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.480464935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.480504036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.480588913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.483778000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.526205063 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.827181101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.827596903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.827665091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.827800989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828049898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828089952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828114033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.828165054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828227997 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.828428984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828646898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.828702927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.828911066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829216003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829253912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829276085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.829375982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829432011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.829471111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829597950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.829651117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.829730034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.830168962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.830225945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.830267906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.830373049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.830430031 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.831104994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.831193924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.831247091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.831429005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.831486940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.831536055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.832119942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832159042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832209110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.832284927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832323074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832376003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.832392931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832849026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.832906008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.833198071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833235979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833307028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.833323956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833450079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833499908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.833667994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833864927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.833921909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.834394932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.834471941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.834527969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.834825039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.834876060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.834983110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:48.835278988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.835367918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:48.835412979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.173861980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.173890114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.173954964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.174932957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.178577900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.178637981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.178787947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.179625988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.179680109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.180066109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180109978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180130959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180155993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.180407047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180425882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180457115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.180777073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180829048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.180845976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.229262114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.530267954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.530978918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.531018019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.531169891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.531227112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.531287909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.531348944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532061100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532118082 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.532119036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532156944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532212973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.532247066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532535076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532572031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.532591105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.533849955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.533889055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.533912897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.533931017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.533983946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.533986092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.534023046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.534079075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.534137964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.534885883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.534924984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.534944057 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.534997940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.535054922 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.535654068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.536281109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.536318064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.536338091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.537053108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.537143946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.537164927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.537491083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.537528038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.537547112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.537564039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.537620068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.538345098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.542649984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.542823076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.542999029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.544398069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.544450045 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.545236111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545272112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545310020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545327902 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.545346022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545382977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545396090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.545419931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545456886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545469999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.545495033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.545547009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.877933979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.877974987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.878078938 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.878536940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.878988981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.879054070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.879097939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.882029057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.882489920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.882560968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.882942915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.883460999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.883526087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.883645058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.883682966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.883704901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.883832932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.883910894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:49.883966923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:49.932374001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.230945110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231070995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231338978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.231610060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231650114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231692076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231795073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231807947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.231833935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231874943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.231894970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.231925964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.232387066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.232497931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.232549906 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.232642889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.232686996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.232743025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.233011007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.233330011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.233464003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.233505964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.233531952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.233584881 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.233792067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.233901978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.235668898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.235733032 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.235735893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.236035109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.236073971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.236088991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.236130953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.236421108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.236512899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237158060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237210989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.237355947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237442970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237494946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.237504005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237549067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.237823009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.237895966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238193989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238250017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.238538027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238657951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238707066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238717079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.238756895 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.238807917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238882065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.238933086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.239202976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.239581108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.239620924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.239674091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.239698887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.239748001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.578427076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.578582048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.578676939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.578682899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.583074093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.583129883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.584184885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.584373951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.584410906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.584422112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.585042953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.585091114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.585098982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.585129976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.585176945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.585532904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.585592985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.585647106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.587752104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.635535955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.990308046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.990335941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.990386963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.990400076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.990994930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991038084 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.991055965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991117001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991159916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.991259098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991342068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991384983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.991540909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991786957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.991827965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.991847038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.992074013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.992114067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.992132902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.992213964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.992254972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.992835999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.993128061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.993180990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.993302107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.993385077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.993431091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.993443012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994487047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994585991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.994587898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994621038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994661093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.994733095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994812012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.994853020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.996102095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.996784925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.996838093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.996840000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.997577906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.997622967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.997682095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.997761011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.997801065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.998328924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999144077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999164104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999185085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.999283075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999324083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.999349117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999402046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999418974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999444008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:50.999797106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:50.999845028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.000375986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.000437021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.000478983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.335119009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.335366011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.335424900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.335593939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.339637041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.339695930 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.340534925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.340884924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.340931892 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.341170073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341320992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341373920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.341387033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341463089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341515064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.341655016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341711998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.341774940 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.341785908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.385464907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.706873894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.706937075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.707190037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.707940102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.708209038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.708271980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.708272934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.708313942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.708527088 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.708887100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.709444046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.709503889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.709563017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.709888935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.709958076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.710510969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.710572958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.710829020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.710917950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.710956097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.711163998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.711530924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.711941004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.711977959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.712008953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.712016106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.712201118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.712719917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.712857008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.712975025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.713901997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.713948011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.713985920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714025974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714027882 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.714063883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714099884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.714699984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714776039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714814901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.714818001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.714879036 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.714885950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.715015888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.715192080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.715401888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.715615988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.715693951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.715852976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.716484070 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.716521978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.716698885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.716732979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.716778994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.716850996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.717092037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.717178106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:51.717420101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.717487097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:51.717622042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.054001093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.054678917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.054867983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.055166960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.082307100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.082832098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.082999945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.083086014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.083174944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.083908081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.084364891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.084407091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.084708929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.085531950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.085572958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.085609913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.086244106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.086303949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.086343050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.086344957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.086555004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.433475971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.433969975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434010983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434075117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434124947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.434350967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434391022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.434438944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434530020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.434575081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.435224056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.435297012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.435340881 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.436213970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.436283112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.436310053 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.436367989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.436517000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.436691046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.436989069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.437093973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.437102079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.437911987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.437989950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.438117981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.438158035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.438586950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.438627005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.438736916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.438775063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.438815117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.439315081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.439762115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.439801931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.439821959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.439876080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.439905882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.439944983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.440032005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.440692902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.440776110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.440934896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.440947056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.441070080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.441107035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.441709995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.441750050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.441765070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.441791058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.441956997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.442163944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.443470001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.443511963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.443602085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.444524050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.444561005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.444744110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.444962025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.445050001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.445152998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.445197105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.494935989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.790234089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.790533066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.790607929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.790776014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.791058064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.791136980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.791512966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.791554928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.791591883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.791626930 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.792262077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.792320967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.792668104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.792850971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.792922974 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.792922974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.792960882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.793239117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:52.794054985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:52.838589907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.148657084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.148786068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.148823977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.148858070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.149070024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.149316072 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.149684906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.153825045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.153887033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.153894901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.153965950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154022932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154064894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154136896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154174089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154207945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154254913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154293060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154306889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154329062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154376030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154397964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154438019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154474974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154484987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154577017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154614925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154633045 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.154736996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.154792070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.155466080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.156557083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.156636000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.157104969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.157773972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.157812119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.157830000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.158214092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.158277988 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.158902884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.159126997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.159164906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.159219027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.160028934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.160083055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.160110950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.161030054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.161122084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.161135912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.161159992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.161211014 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.161509037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.162184954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.162221909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.162261009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.162765980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.162805080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.162821054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.163800001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.163836956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.163858891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.213599920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.493408918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.494384050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.494493961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.503129959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506421089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506478071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506488085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.506515980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506552935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506568909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.506592035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.506647110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.508697033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.509737015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.509799004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.509918928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.510436058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.512121916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:53.514823914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:53.659529924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.009520054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.010062933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.010179996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.010262966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.010410070 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011168003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011245012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011312008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.011437893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011485100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011529922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011548996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.011564970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.011564970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.011599064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.012896061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.012929916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.012989044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.013031960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.013072968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.013135910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.013189077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.013237953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.014512062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.014564991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.014566898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.014643908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.014662027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.014693022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.014718056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.014736891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015285015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015327930 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.015563965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015589952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015631914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015635967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.015697002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015743017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.015790939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.016453028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.016860008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.016910076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.016936064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.016980886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.017020941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017060995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017110109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.017288923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017328978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017375946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.017776012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017848015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017899990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.017949104 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.018481970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.018754959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.018805027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.018815041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.018861055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.356005907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.356075048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.356117010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.356177092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.356726885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.356787920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.356995106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357094049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357141972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.357229948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357264996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357340097 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.357769012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357806921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357845068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.357901096 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.358856916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.358947039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.358968019 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.358983994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.359127998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.704703093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705033064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705096960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705112934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.705135107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705194950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.705287933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705950022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.705987930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.706012011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.706427097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.706465960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.706490993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.706502914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.706556082 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.706646919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.707122087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.707190990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.707225084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.707294941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.707349062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.708139896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.708401918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.708465099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.708848953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.708887100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.708947897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.709311008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.709403992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.709460020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.709666967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.709723949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.709778070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.710345030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710382938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710438967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.710463047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710536003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710572004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710587978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.710673094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710710049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.710724115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.711262941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711302042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711328030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.711446047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711483002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711502075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.711702108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711759090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.711765051 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.712482929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712519884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712538958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.712555885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712593079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712610960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.712662935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712699890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:54.712713957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:54.869941950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.054584980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.055747986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.055845022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.055970907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.059284925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.059353113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.060103893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.060146093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.060198069 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.061528921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.063271046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.063308954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.063338041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.065844059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.065932035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.065947056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.065972090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.066013098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.066028118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.166837931 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.513183117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513336897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513449907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.513587952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513628960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513679028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513717890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.513762951 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.513998032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.514044046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.514265060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.514323950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.514621019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.514759064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.514816046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.515029907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515074015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515110970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515130043 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.515350103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515399933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515407085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.515439987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515491962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.515583992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515620947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.515671015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.515898943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516499043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516537905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516558886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.516787052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516841888 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.516851902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516890049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.516942978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.516962051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.517272949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.517338991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.518127918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.518290997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.518345118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:55.518537045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.518584967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:55.518634081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.002147913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.376730919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.376789093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.376859903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.377193928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.377298117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.377358913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.377490997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.377547979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.377584934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.377600908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.378287077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.378325939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.378345013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.378362894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.378423929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.378565073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.378638983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.378693104 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.379304886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379343987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379379034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379399061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.379566908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379605055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379620075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.379662037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.379713058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.380271912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.380563974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.380601883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.380620003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.381236076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.381308079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.381308079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.381344080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.381395102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.726463079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.726670980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.726747990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.727227926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727303982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727351904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727354050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.727427959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727471113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.727669001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727720022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727859974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.727902889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728053093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728142023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728177071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728185892 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728223085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728281975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728338957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728382111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728535891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728579998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728621960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728646040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728681087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728909016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.728952885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.728967905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.729441881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.729490042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.730607033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.730658054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.730698109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.731024027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.731117010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.731295109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.731339931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.731380939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.732225895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732291937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732325077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732342005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.732532024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732686996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.732753992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732829094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.732868910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.733498096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.733828068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.733872890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.733889103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.733964920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.734009027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.734052896 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.734436035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.734478951 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.734659910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.735054970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.735188007 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:56.735280037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:56.963599920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.072511911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.073494911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.073556900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.077172995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.077759027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.077810049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.078167915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.078283072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.078433990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.078752041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.078824043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.078860998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.078918934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.079108953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.079159975 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.079232931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.079375029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.079441071 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.080971956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.080991983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.081048012 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.424915075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.424981117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.425021887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.425103903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.425863981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.425909996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.425925016 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.425947905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.426019907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.426062107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.426069021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.426574945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.426656008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.426697016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.426739931 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.430625916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.430846930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.430887938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.430903912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.431548119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431602955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431643963 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.431643963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431766033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.431780100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431819916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431871891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.431916952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.432409048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.432459116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.432466030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.432552099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.432589054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.432602882 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.432878017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.432926893 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.433490038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.433563948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.433752060 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.433852911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.433911085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.433990002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.434045076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.434919119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.434971094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.435024023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.435266018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.435314894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.435614109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.435674906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.435724974 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.436281919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.436727047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.436779976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.437863111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.437906027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.437975883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.438839912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.439280033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.439317942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.439337015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.557357073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.771235943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.773381948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.773425102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.773479939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.773802042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.773907900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.774738073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.774777889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775024891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.775064945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775103092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775139093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775160074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.775477886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775542021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.775679111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775717974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.775799990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:57.777524948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:57.869853020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.124073982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124428034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124502897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.124520063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124560118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124619961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.124682903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124722004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.124814987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.125307083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.125552893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.125607967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.125938892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126015902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126084089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126121044 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126140118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.126285076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126338005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.126727104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.126831055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.126914978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127017975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127054930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127075911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.127196074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127254009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.127262115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127711058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.127763033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.128082991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128201008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128269911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.128274918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128315926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128353119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128408909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.128762007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.128842115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.129085064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129156113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129192114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129213095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.129296064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129349947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.129713058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129786968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.129862070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.130242109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.130412102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.130450010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.130501986 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.130810022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.130883932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.130896091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.131468058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.131515980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.131522894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.131953955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.131990910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.132013083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.369854927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.471920013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.471971989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472024918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.472125053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472677946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472727060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472728968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.472826958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472865105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.472877026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472934008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.472975016 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.472996950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.473242998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.473403931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.473443985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.473462105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.473591089 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.473721981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.557352066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.764051914 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.817970037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818082094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.818104982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818169117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818197966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818223000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.818269968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.818428993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818481922 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.818485975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.818527937 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.818931103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819016933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819065094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.819207907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819225073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819302082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819334030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.819346905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819389105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.819552898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.819983006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.820069075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.820086956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.820230007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.820274115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.820455074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.820636988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.820708990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.821201086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821275949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821333885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821345091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.821660995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821707010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.821784973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821940899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.821985960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.822663069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.822747946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.822783947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.822824001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.823832035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.823896885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.823923111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.823960066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.824018002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.824088097 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.824095964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.824134111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.824517965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.824593067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.824631929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.825485945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.825500965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.825536966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.825562000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.825722933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.825764894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.825802088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.825864077 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.826149940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.826195002 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.826504946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.826802969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:58.827435017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:58.827478886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.145493984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.163671970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.163780928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.163867950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.164175034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.164443970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.165605068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.167929888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.168343067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.168564081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.168612957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.168629885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.168675900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.169198036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.169275999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.169467926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.169581890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.169640064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.170444012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.170536041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.516716003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.516746044 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.516822100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.518095970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.518258095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.519218922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.519273043 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.519543886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.519591093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.519768953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.519783974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.519850969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.519881964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.520937920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.521962881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.522041082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.522059917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.522073984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.522237062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.522886038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.522933960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.523691893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.523706913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.523756981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.523761034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.523775101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.523823023 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.523848057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.524374008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.524490118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.524537086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.524547100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525001049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525048971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525051117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.525093079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.525105000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525155067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525199890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.525749922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525830984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.525883913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.525959015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.526026011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.526071072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.526115894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.526295900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.526707888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.526755095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.527427912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.527470112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.527502060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.527551889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.527597904 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.527630091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.527704954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.527754068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.530941010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.530955076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.530975103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.531006098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.666811943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.865317106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.865605116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.865675926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.865757942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866411924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866473913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866513014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866549015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866626024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.866626024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.866828918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.866879940 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.870661020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.870830059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.870883942 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.871747971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.871915102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.871984005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:30:59.871984959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:30:59.963612080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.223191023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.223999977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.224088907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.224093914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.224111080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.224148989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.224334955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.224381924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.224422932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.225395918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.225627899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.225667953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.225673914 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.226121902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.226161957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.226183891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.226418018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.226466894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.227451086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228305101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228328943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228346109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228364944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.228405952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.228416920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228435993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.228475094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.229928970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.229967117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.230007887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.230144024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.230190992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.230235100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.231004000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.231070042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.231125116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.231695890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.231772900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.231806993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.231812000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.232981920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.233025074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.233040094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.233069897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.233110905 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.233727932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.233753920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.233799934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.233814001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.234929085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.234946012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.234972000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.235830069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.235881090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.236547947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.236574888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.236613035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.236713886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.237232924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.237278938 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.237319946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.369852066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.572547913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.572604895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.572655916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.572665930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.572863102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.572911024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.573478937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.573585033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.573635101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.574259043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574351072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574407101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.574439049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574608088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574644089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574656010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.574783087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.574872017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.577183008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.666749001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.923319101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.923345089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.923433065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.923662901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924638033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924717903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924719095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.924757004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924819946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924850941 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.924895048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.924957991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.925108910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.925657034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.925714016 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.925901890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.925940037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.925992966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.926531076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.926909924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.926949978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.926970005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.927344084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.927406073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.928059101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928168058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928205967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928257942 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.928303003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928359032 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.928570032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928607941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928661108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.928885937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928934097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.928986073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.929225922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.929263115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.929316044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.929644108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.929728985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.929785013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.930150986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.930212975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.930278063 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.930289030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.930680037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.930787086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.931246042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.931284904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.931356907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.931380987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.931432009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.931494951 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.931598902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.932274103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.932317019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.932353973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:00.932353973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:00.932409048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.271512985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.271559000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.271590948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.271611929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.271868944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.271913052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.272800922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.272916079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.272954941 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.273178101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.273288012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.273329973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.273432016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.273638964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.273683071 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.274626970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.275230885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.275284052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.275285959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.446789980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.619446039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.619853020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.619921923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.619959116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.620326042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.620392084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.620426893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.620454073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.620486021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.620518923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.620965004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621020079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.621032000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621248960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621285915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621295929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.621335983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621395111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.621443033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.622041941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.622107983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.622159004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.622199059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.622246981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.622387886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.622440100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.622488976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.622492075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623169899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623224974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623225927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.623258114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623306990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.623588085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623698950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623733997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.623800993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.624349117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.624399900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.624573946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.624680996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.624819040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.624870062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.624891996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.624954939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625004053 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.625017881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625081062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.625235081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625272989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625325918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.625659943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625746012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.625794888 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.626034975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.626916885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.627073050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.627139091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.627146006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.627667904 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.963920116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.964309931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.964839935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.964919090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.964924097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.965416908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.965456963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.965476990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.965522051 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.968880892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.969271898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.969953060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.970041990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.970515013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.970571041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.970582962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.971292019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:01.971359968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:01.971720934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.057356119 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.318833113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.318888903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.318929911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.318957090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.319178104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.319227934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.319762945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.319843054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.319880009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.319896936 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.319932938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.319976091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.320005894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.320741892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.320796967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.321024895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321105957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321154118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.321177959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321538925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321588039 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.321634054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321687937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.321728945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.322396994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.322459936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.322586060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.322623014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.322637081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.322685003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.323357105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.323451996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.323539972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.323559046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.323596001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.323832035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.323846102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.324337959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.324398041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.324882984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325016975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325074911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.325155973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325193882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325248957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325303078 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.325741053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.325793028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.325997114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.326236010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.326726913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.326896906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.326958895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.326994896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.327042103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.327698946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.327754021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.328244925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.328305960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.328363895 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.575448036 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:02.665303946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.665349007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.665436983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.666254044 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.666467905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.666518927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.666620970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669079065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669153929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.669287920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669441938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669488907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.669495106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669734001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.669778109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.670236111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.670295000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.670322895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:02.670380116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:02.760288954 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:02.764228106 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:02.797898054 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:02.985215902 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:02.985253096 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:02.985270023 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:02.985306025 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:02.985323906 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:02.985411882 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.021217108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.021282911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.021321058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.021393061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.021800995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.021841049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.021874905 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.021970987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.022011995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.022025108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.022382975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.022422075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.022442102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.023034096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.023087978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.023293972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.023335934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.023392916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.023854971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.023894072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.023966074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.023969889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.024043083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.024079084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.024090052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.024118900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.024173021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.024863958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025029898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025104046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.025289059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025327921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025369883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025415897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.025494099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.025660038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.025928974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026254892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026340008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026376009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026392937 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.026417017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.026433945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026504040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.026710987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.027600050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.027725935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.027858019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.027894974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.027918100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.027960062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.028292894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.028330088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.028395891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.028413057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.028960943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.029046059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.029112101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.029654026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.029719114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.029730082 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.166745901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.170409918 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170433998 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170453072 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170469999 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170485973 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170500040 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.170502901 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170519114 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170526028 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.170536995 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.170543909 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.170579910 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.355868101 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.355892897 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.355954885 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.355973005 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.355979919 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.355990887 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356008053 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356015921 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356049061 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356057882 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356108904 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356126070 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356158018 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356415987 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356477022 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356523037 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356589079 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356626034 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356662989 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356674910 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356723070 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356743097 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.356764078 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.356977940 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.373130083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.373172045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.373652935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.373929977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.373997927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.374059916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.374310970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.374373913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.374443054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.374495983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.374551058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.374691010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.374820948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.375349998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.375423908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.375430107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.375499010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.375552893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.375613928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.541114092 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541198969 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541290045 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541289091 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541327953 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541367054 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541404009 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541428089 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541440964 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541460991 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541481018 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541517973 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541553974 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541574955 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541590929 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541621923 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541646004 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541733027 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541800976 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541795015 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541862011 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.541897058 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541934967 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.541975975 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542010069 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542012930 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542049885 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542085886 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542110920 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542135000 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542149067 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542256117 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542308092 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542342901 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542361975 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542380095 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542422056 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542428017 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542458057 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542493105 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542527914 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542529106 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542558908 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542568922 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542606115 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542642117 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.542651892 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.542702913 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.720385075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.721914053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.721987963 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.721995115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722244024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722299099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.722302914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722376108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722434998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722484112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.722515106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722560883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.722598076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722685099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722733974 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.722740889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722801924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722826004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.722855091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.723936081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.723965883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.723989964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.724052906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.724081993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.724124908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.724128962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.724286079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.724510908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.724560976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.724762917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.725330114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.725394964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.725563049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.726046085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726084948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726135969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.726152897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726221085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726267099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726269007 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.726821899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.726881981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.726947069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.727008104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.727065086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.727078915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.727092981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.727138996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.727318048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728030920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728049040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728080988 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.728105068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728241920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.728272915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728338957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.728403091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.729306936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.729861975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.729878902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:03.729929924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.730082989 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730146885 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730194092 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730196953 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730272055 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730288982 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730321884 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730374098 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730396032 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730438948 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730458975 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730516911 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730525017 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730541945 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730588913 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730592012 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730652094 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730690002 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730709076 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730726004 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730762959 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730794907 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730820894 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730850935 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.730901003 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.730943918 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731013060 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731014013 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731029034 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731123924 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731141090 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731169939 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731187105 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731206894 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731247902 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731265068 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731285095 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731333971 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731372118 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731409073 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731424093 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731462002 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731492996 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731548071 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731574059 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731599092 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731631994 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731657982 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731687069 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731756926 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731801033 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731828928 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731925964 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.731962919 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.731978893 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732032061 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732069969 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732084036 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732135057 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732158899 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732193947 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732232094 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732276917 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732280016 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732337952 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732361078 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732383966 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732426882 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732460976 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732485056 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732531071 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732566118 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732595921 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732625961 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732664108 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732692003 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732707977 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732769012 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732809067 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732817888 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732857943 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.732912064 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732928038 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.732976913 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.733009100 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733118057 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733163118 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.733215094 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733246088 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733294964 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.733305931 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733421087 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733467102 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.733475924 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733537912 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.733679056 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.858108044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:03.916419029 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916457891 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916531086 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916567087 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.916642904 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916726112 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916779041 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916784048 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.916838884 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.916879892 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.916960955 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917030096 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917041063 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917083025 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917140007 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917148113 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917221069 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917251110 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917277098 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917366028 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917423010 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917431116 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917479992 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917627096 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917679071 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917740107 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917788029 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.917870045 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.917922020 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918010950 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918059111 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918227911 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918277025 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918319941 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918421984 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918530941 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918581963 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918639898 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918687105 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918699026 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918741941 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918777943 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918827057 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918864012 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918880939 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918912888 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918925047 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.918973923 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.918998957 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919037104 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919073105 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919120073 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919145107 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919166088 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919192076 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919210911 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919296026 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919312000 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919344902 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919370890 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919375896 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919446945 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919464111 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919496059 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919539928 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919579983 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919604063 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919614077 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919653893 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919668913 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919691086 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919744015 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919801950 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919811010 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919852972 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919857025 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.919910908 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.919985056 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920072079 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920166016 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920222998 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920223951 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920290947 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920341969 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920371056 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920414925 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920480967 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920528889 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920579910 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920634985 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920646906 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920752048 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920806885 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.920834064 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920937061 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.920993090 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921010971 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921081066 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921127081 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921176910 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921202898 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921224117 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921266079 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921277046 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921314955 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921327114 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921389103 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921473980 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921509027 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921572924 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921634912 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921678066 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921742916 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921792030 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.921823978 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921917915 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.921994925 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922014952 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922084093 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922139883 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922142982 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922198057 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922267914 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922318935 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922327042 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922375917 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922391891 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922415972 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922460079 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922466993 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922494888 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922569990 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922594070 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922619104 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922657967 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922681093 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922688007 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922739983 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922754049 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922805071 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922833920 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922851086 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.922878981 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922928095 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.922976017 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923012018 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923064947 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923080921 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923151016 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923202991 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923230886 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923249006 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923280001 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923290014 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923386097 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923475027 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923491001 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923522949 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923551083 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923597097 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923672915 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923722982 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923789978 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923897028 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.923959970 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.923970938 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924024105 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924092054 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924125910 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924144030 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924175024 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924180031 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924247980 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924299002 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924302101 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924365044 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924395084 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924460888 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924504995 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924509048 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924510002 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924585104 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924617052 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924658060 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924691916 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924715996 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924737930 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.924772978 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924849033 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:03.924897909 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:03.930419922 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.068208933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.068270922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.068351984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.073254108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.073749065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.073812962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.073817015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074235916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074290037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.074439049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074521065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074594975 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.074729919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074862003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074901104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.074904919 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.075185061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.075242043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.075300932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.101541996 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101583958 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101623058 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101692915 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101737022 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.101737022 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.101768970 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101807117 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101819038 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.101861954 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101898909 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101916075 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.101957083 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.101993084 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102045059 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102049112 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102122068 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102130890 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102202892 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102240086 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102298975 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102308035 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102346897 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102363110 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102488995 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102526903 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102582932 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102611065 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102636099 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102705956 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102745056 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102817059 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102870941 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102873087 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102926970 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.102927923 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102965117 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.102999926 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103063107 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103064060 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103111982 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103135109 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103207111 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103254080 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103312969 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103326082 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103363037 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103378057 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103430033 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103499889 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103548050 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103558064 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103625059 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103631020 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103696108 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103743076 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103806019 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103806973 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103856087 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.103872061 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103928089 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.103981018 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104034901 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104047060 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104084015 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104100943 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104154110 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104198933 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104283094 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104307890 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104335070 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104352951 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104402065 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104446888 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104506969 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104567051 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104619980 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104629040 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104684114 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104731083 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104792118 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104804993 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104859114 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.104859114 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104916096 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.104991913 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105036974 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105045080 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105094910 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105096102 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105132103 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105168104 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105223894 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105228901 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105293989 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105300903 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105365992 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105401039 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105437040 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105456114 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105473042 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105487108 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105531931 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105586052 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105637074 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105638981 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105689049 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105691910 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105747938 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105801105 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105858088 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105870008 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105885983 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105916977 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105920076 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105932951 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.105981112 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.105998039 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106044054 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106045961 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106136084 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106223106 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106240034 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106281996 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106302977 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106307030 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106497049 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106513977 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106547117 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106576920 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106622934 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106658936 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106676102 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106739044 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106787920 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106794119 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106837034 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106853962 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106870890 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106930971 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106967926 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.106976032 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.106997013 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107027054 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107094049 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107117891 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107161045 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107171059 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107211113 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107242107 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107265949 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107316971 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107342958 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107347965 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107388973 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107398033 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107475042 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107523918 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107527018 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107544899 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107609987 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107630968 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107635975 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107697964 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107744932 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107757092 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107803106 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.107831001 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107883930 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107929945 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107973099 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.107984066 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.108031988 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.108042955 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.108062983 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.108144999 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.108145952 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.108206034 CET	80	49738	173.248.130.117	192.168.2.4
Mar 10, 2024 17:31:04.108380079 CET	49738	80	192.168.2.4	173.248.130.117
Mar 10, 2024 17:31:04.424211979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424277067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424350977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424417019 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.424618959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424685955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.424765110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424901009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.424952984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.425024033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.425129890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.425180912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.425214052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.425247908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.425295115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.425957918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.425976038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.426084042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.426132917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.427181005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.427232981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.427248955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.427318096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.427382946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.427424908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.427689075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.427735090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.428626060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.429522991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.429672956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.429707050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.429897070 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.429944992 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.430001020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.430614948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.430660963 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.430664062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.431143999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.431217909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.431261063 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.431287050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.431396008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.431940079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.432002068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.432121038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.432141066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.432799101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.432843924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.432862043 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.433368921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.433413982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.433526039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.433784962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.433831930 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.433883905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.434855938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.434957981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.434982061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.435024977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.435082912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.435347080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.435817957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.436077118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.776360989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.776386023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.776465893 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.781497002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.781514883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.781531096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.781578064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.781656027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.781923056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.782330036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.782490969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.782512903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.782530069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.782562017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.782620907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:04.782990932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.783016920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.783163071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:04.783236980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.130594969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.131685019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.131745100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.131798983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.131850958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.131952047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.131962061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132018089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132076025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132142067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132169008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.132195950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.132601023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132652998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132708073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132767916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.132817984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.133052111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.133152008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.133219004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.133413076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.133479118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.133662939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.134656906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.135164022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.135209084 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.135257006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140189886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140252113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.140271902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140306950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140367031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140424967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140464067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140470982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.140530109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140571117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140623093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140641928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.140662909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140664101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.140753031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140773058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140813112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140856981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.140870094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140887022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140949965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.140995026 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.141055107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141067982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141084909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141125917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.141170979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141243935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141256094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.141294003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.478796005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.478816032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.478827953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.478883982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.479702950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.479717016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.479780912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.479885101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.479899883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.479983091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.482763052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.482867956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.482919931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.482938051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.482990026 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.483439922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.483596087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.483674049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.483771086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.566941977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.832392931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.832710028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.832765102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.832806110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.832916975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.833002090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.833048105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.833131075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.833436012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.833481073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.833488941 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.833523989 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.833556890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834055901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834132910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834180117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.834595919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834646940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834692955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.834736109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834835052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.834880114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.835087061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835128069 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.835649014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835704088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835747004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835752964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.835783005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835838079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.835881948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.836864948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.836896896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.836946011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.837024927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.837065935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.837219000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.837326050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.837366104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.837368965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.837959051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838005066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.838016033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838109016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838126898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838170052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.838211060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838258028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838299990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.838902950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.838948011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.839232922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.839283943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.839329004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.839421034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.839469910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.839512110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:05.839515924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.839956999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.840117931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:05.840167046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.178250074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.178282976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.178391933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.178435087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.178935051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.179402113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.179449081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.179461002 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.179502010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.179554939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.182121992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.182723045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.182784081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.182790995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.183362007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.183413982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.183706045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.183756113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.183765888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.266217947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.272957087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.613877058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.614811897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.614833117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.614911079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.615536928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.615587950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.615638971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.615653038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.615678072 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.615706921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.615770102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.615808964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.615833044 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616446018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616504908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616547108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.616759062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616826057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616861105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.616867065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.616899967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.617816925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.618444920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.618498087 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.618525982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.618539095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.618577957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.619832993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.620606899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.620672941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.620722055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.621833086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.621864080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.621902943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.621948004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.622026920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.622064114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.622306108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.622323990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.622343063 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.622368097 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623048067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623131037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623167038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623172998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623222113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623260021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623450041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623462915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623486042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623511076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623766899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623809099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.623832941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623877048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.623918056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.624480009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.624540091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.624582052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.624927998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.625010014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.625066042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.625122070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.653696060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.961065054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.961824894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.961906910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.961937904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.962470055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.962537050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.962572098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.962634087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.962940931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.962990999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.967957973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.968003035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.968070030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.968322992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.968826056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.968883038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:06.968897104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.968916893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:06.969011068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.313278913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.313769102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.313843966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.314292908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314369917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314388037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314444065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.314734936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314790964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314805984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.314851999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.314995050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.315181971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.315289021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.315387964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.315445900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.315501928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.315701008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.315965891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316034079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.316188097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316252947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316381931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316431046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.316564083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316580057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.316627979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.317434072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.317481041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.317497015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.317523956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.317682981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.317730904 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.317786932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.317847013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.317967892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.318552017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.318598986 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.318608046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.318701029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.318762064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.319396019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.320916891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.321108103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.321815968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.321907997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.321990013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.322038889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.322062969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.322346926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.322474003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.322912931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.322967052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.322988987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.323043108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.323086977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.323103905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.323208094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.323327065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.324135065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.367822886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.664860964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.664882898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.665009022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.666779041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.667280912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.667344093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.667728901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.667834997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.667891026 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.668126106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.668226004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.668283939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.668615103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.668658018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.668706894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.669411898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.670178890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.670216084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:07.670264006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:07.754118919 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.030250072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.030282021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.030320883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.030389071 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.030740976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.030975103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.031016111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.031037092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.031070948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.031299114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.031830072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.031879902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.031933069 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.032049894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032107115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032159090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.032255888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032331944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032383919 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.032699108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032784939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032808065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.032866001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032921076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.032928944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.032958031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033071995 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.033241987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033281088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033339024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.033540964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033631086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033682108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033711910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.033746958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033797979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.033855915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.034039974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.034128904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.034183025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.034185886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.034240007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.034277916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.034291983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.034321070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.035089016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.035197020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.035248995 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.035937071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.035954952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.036010027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.036016941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.036070108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.036119938 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.036151886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.037240982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.037307024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.037616968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.037674904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.037728071 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.377325058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.377852917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.377959013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.378308058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.378361940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.378416061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.382580996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.382926941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.383135080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.383200884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.384157896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.384190083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.384253979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.384309053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.384378910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.384778023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.384802103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.384886980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.387492895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.465033054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.729764938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.730323076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.730428934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.730451107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.735709906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.735780954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.735836983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.735842943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.735937119 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.736413002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736514091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736529112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736577034 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.736655951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736730099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.736763000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736819983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.736871004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.737273932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.737493038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.737577915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.737593889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.737668037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.737726927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.738246918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738289118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738342047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.738569975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738581896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738617897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738626003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.738859892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.738914967 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.739176035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.739239931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.739301920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.740089893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740129948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740181923 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.740210056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740272045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740324020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.740552902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740849972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.740917921 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.741617918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.741662025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.741714001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.741749048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.741780043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.741839886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.742360115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.742407084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.742502928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.742562056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.742688894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.742737055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.743298054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:08.743989944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:08.744044065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.078692913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.079329967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.079382896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.079391003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.084449053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.084928036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.085289955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.085355043 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.085601091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.085997105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086009979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086066008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.086077929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086280107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086309910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.086342096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086404085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.086436987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.265902042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.433263063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.433336020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.433388948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.433917046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.434526920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.434580088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.434590101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.434905052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.434973001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.434981108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.435333967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.435406923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.435458899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.435910940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.435964108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.436441898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.436511993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.436628103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.436652899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.437486887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.437549114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.437688112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.437709093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.437829971 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.438086987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.438172102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.438184977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.438219070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.439253092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.439302921 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.439652920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.440128088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.440269947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.440319061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.440337896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.440390110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.440416098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.441632032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.441703081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.441764116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.442157984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.442285061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.442346096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.442395926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.442446947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.442447901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.443696022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.443763971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.443823099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.443859100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.443876028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.443905115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.444211006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.444515944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.444950104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.445000887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.445269108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.445765018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.445931911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.779545069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.779891968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.779953957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.780333042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.784673929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.784728050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.784732103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.784775019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.784827948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.785425901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.785460949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.785536051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.785590887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.785638094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.785689116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.786572933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.786634922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.786711931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:09.786750078 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:09.968997955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.130431890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131021023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131088018 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.131179094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131422997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131560087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131608009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.131619930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131689072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131716013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.131836891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.131953955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.132169008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.132245064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.132298946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.132467985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.132550955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.132683039 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.132832050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.133565903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.133610010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.133754015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.134152889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.134207964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.134258986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.134958982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.135021925 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.135380983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136012077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136069059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136125088 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.136249065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136307955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136357069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136378050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.136410952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136457920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.136873960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136930943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.136977911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.137564898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.137633085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.137759924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.138108015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.138156891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.138197899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.139012098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.139079094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.139729977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140188932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140235901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.140388012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140515089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140568018 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.140589952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140683889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.140741110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.141467094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.141511917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.141571999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.478548050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.479599953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.479681015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.479844093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.479895115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.480015039 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.480537891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.480618000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.480688095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.480736017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.480923891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.480982065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.481578112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.481646061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.481859922 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.482254028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.482331991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.482398033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:10.482904911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:10.656505108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.002808094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.003456116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.003530979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.009604931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.009809971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.010227919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.010288954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.010288000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.010324955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.010340929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.010394096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.011255980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.011622906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.012178898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.012262106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.012408018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.012835026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.012891054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.013292074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.013509035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.013560057 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.014034033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.014729023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.014796019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.014832020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.014851093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.014878035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.015115023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.015156031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.015209913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.015676022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.016498089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.016566038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.016861916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.017333984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.017610073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.017990112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.018038988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.018161058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.018452883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.018779993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.018830061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.019398928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020057917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020116091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020119905 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.020152092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020205021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.020281076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020661116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.020708084 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.020802975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022164106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022202969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022214890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.022404909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022461891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.022599936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022654057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.022696972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.347767115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.349069118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.349082947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.349564075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.357925892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.358000994 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.358077049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.358089924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.358136892 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.358685970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.358867884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.358916998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.358949900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.359018087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.359074116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.359107971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.359405041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.359472990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.359616041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.469084978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.706701040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707114935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707159042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707186937 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.707212925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707346916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.707427979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707482100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.707525015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.707736015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708262920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708307981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.708332062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708399057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708446980 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.708810091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708848953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.708889961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.708918095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.709168911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.709211111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.709228992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.709295988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.709341049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.710258007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710387945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710433006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.710441113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710459948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710499048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.710510969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710794926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710846901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710850954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.710882902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.710922956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.711296082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.711354017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.711397886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.711421967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.711602926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.711649895 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.712310076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.712376118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.712428093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.712440014 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.712547064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.712590933 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.712910891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713006973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713049889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.713160038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713200092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713241100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.713244915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713310003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.713351011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:11.713790894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.714102983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:11.714148045 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.100641966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.100820065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.100888968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.101294041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.101871967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.101919889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.103087902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.104679108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.104726076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.104743004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.105200052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.105247021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.105366945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.105684996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.105732918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.106745005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.106834888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.106874943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.108817101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.108840942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.108906984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.458638906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.458656073 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.458882093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.459244967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.460283995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.460299015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.460311890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.460347891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.460411072 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.460479021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.461971045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.462014914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.462032080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.462907076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.462964058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.462966919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.463013887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.463068962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.464066982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.464730024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.464824915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.465104103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.466789961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.466847897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.466865063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.466967106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.467140913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.467351913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.467525005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.467577934 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.467866898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.469856977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.469893932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.469917059 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.470179081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.470233917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.470402002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.470439911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.470489025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.470606089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.472142935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.472203016 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.472759962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473004103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473053932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.473222017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473342896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473407984 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.473491907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473555088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.473604918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.474590063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.475234985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.475282907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.475317001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.475322008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.475370884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.475920916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.476236105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.476289988 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.476737022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.656618118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.831871033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.831996918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.832057953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.832343102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833502054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833569050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833631992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833652973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.833683968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.833688021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833753109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833786964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.833801985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.834314108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.834372044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.834382057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.834431887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.834490061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:12.834505081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:12.969135046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.187871933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188050985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188230991 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.188263893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188338041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188487053 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.188561916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188927889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.188985109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.190148115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.190418005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.190479994 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.191529989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.191848993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.191900969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.192197084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.192240000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.192286968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.192395926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.192496061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.192547083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.193957090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.194029093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.194082022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.194353104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.194960117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.195014954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.195043087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.195154905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.195205927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.196325064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.196770906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.197052956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.197516918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.198255062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.198292971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.198334932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.198349953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.198401928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.198851109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.199398041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.199450970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.200721979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.201030970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.201086998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.201112032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.201149940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.201206923 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.201803923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.201945066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.202007055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.203928947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.204099894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.204118013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.204253912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.204464912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.204521894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.205027103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.205113888 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.205163002 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.208362103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.265904903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.552393913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.552505016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.552670002 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.552860975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553030014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553083897 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.553170919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553190947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553206921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553240061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.553405046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553452969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.553596020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553615093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553632975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553652048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553664923 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.553669930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.553706884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.580974102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.819513083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.927958965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.928709984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.928761005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.928780079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.929311991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.929356098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.929380894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.929441929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.929495096 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.930363894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.930706024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.930757999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.930877924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.930975914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.931025982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.931297064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.931313992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.931369066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.931401968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.932178974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.932248116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.932286024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933212042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933262110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933263063 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.933387041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933444977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.933458090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933732033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.933788061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.933870077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.934664965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.934715986 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.935174942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.935216904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.935256004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.935267925 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.935455084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.935508013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.935580015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937382936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937499046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.937503099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937550068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937601089 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.937690020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937756062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937786102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.937810898 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.942229986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942248106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942264080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942280054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942287922 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.942296028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942310095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.942313910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942361116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.942368984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.942424059 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:13.944679976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:13.944730997 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.205933094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.279140949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.279442072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.279491901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.280011892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.280087948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.280141115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.280267954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.280885935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.280947924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.281006098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.281019926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.281084061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.281909943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.282128096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.282140970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.282176971 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.282686949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.282700062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.282758951 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.469105005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.641350985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.641474009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.641649961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.641681910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.644011021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.644253969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.644304037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.645327091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.645565033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.645579100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.645597935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.646222115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.646636009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647423029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647461891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647512913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647543907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.647568941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647608995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.647638083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.648098946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.649061918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650636911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650650024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650722027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650734901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650749922 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.650801897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.650824070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.650986910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.651338100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.652623892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.652761936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.652774096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.652789116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.652813911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.652827978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.652895927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.653325081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.653687954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.654886961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.654901028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.655069113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.655081987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.655126095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.655180931 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.655716896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.656019926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.656526089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.656604052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.656748056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.656784058 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.657248020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.657260895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.657922983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.658329010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.658451080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.658485889 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:14.658931971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.658943892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:14.659106970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.035254002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.035288095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.035387039 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.036400080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.036422014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.036562920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.036598921 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.037221909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.037323952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.037353992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.038230896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.039094925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.039129019 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.039165020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.039223909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.039244890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.039271116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.039920092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.040258884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.411647081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.411668062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.411833048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.412605047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.412764072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.412811995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.412955999 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.413208961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.413342953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.414051056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.414158106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.414936066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.415014982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.415860891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.416008949 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.416171074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.416671991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.416770935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.417602062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.417700052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.417762041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.418414116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.418893099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.418948889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.418986082 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.419008970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.419251919 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.419421911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.419464111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.419560909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.420697927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.420749903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.420799971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.420953035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.420990944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.421375990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.421422958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.421458006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.422285080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.422591925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.423142910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.423435926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.423475027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.423645973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.423907042 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.425601959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.425693035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.425842047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.425921917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.426465034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.427880049 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.428237915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.428491116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.428584099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.429404020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.429496050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.429589987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.429624081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.430267096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.430680990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.432349920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.577758074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.833780050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.834256887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.834379911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.835340023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.835403919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.835455894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.835468054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.835493088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.835539103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.835896969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.835953951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.836003065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.836595058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.837347031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.837400913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:15.838038921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.838063955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.838085890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:15.838140011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.205733061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.210040092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.210201025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.211410046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.211514950 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.211570024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.211776972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.211849928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.211895943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.211900949 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.214068890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.214118958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.214706898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.215230942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.215286016 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.216368914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.216439009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.216490030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.216557026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.217916012 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.217966080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.218008041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.218765974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.218897104 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.219656944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.219686985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.219918966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.220731020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.220812082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.220896006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.220962048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.222233057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.222284079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.222784042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.222810984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.222919941 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.224005938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.224339962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.224581957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.225264072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.225841045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.225912094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.225965977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.226172924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.226223946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.226784945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.226850033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.226897955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.227682114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.228327036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.228418112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.228451967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.230170965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.230228901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.230422974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.230820894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.230873108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.231673956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.232667923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.232692003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.232743025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.558672905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.558844090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.559180021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.559238911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.560059071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.560076952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.560125113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.560131073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.560180902 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.564297915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.564579010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.564678907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.564915895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.565279007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.565330029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.565332890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.565588951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.565670013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.565917969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.566010952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.566060066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.947458029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.947547913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.947597027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.947932959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.948013067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.948254108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.948360920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.949404955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.949457884 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.949520111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.949625969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.949666023 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.949906111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.950305939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.950359106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.951131105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.952231884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.952296972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.952342987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.952439070 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.952569962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.952964067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.953054905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.953099012 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.954314947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.954523087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.954571009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.954600096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.955162048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.955209017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.955210924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.955271959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.955329895 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.956501007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.956547976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.956604004 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.956739902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.957340956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.957391024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.957967997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.958009958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.958067894 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.959111929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.959161043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.959229946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.959712982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.961234093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.961285114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.961947918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.963449955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.964108944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.964147091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.964257956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.964332104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.964385033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.964869022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.965735912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.965789080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:16.966360092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.966730118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:16.966804981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.319231987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.319272995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.319308996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.319366932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.319853067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.319905996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.319917917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.319964886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.320058107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.320768118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.320821047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.320979118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.321418047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.322057962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.322128057 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.322144032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.322407961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.322446108 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.322480917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.468985081 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.706379890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.707762957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.707839012 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.708267927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.708309889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.708533049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.708599091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.708620071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.708830118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.708875895 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.710266113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.710318089 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.710347891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.710417032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.710464001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.710731983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.711313963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.711333036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.711364985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.712419987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.712471008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.712485075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.712529898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.712577105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.713052988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.713351011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.713402987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.713449001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.714740038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.714787006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.714798927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.714837074 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.714905024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.715531111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.715579033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.715663910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.715842009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.717078924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.717130899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.717581987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.717695951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.717833996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.718097925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.718265057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.718589067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.719073057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.719692945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.719758034 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.720843077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.720891953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.720951080 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.720954895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.721085072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.721142054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.721188068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.722323895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.722387075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.723953962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.724026918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.724077940 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:17.724091053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:17.765842915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.058326006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.058346033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.058413029 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.058811903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.059659958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.059792995 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.060169935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.060237885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.060271978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.060319901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.061049938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.061100006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.062102079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.062186956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.062269926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.062804937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.063493013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.063519001 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.063586950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.113992929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.427159071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.427194118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.427395105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.427791119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.428675890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.428850889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.428904057 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.428961039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.429049969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.429063082 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.429220915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.429265022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.431488037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.432010889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.432095051 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.432557106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.432656050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.432701111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.433077097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.433099031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.433182001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.440202951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440237045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440296888 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.440361023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440382957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440407038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440464973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.440531015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.440581083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.441560030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.441915989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.441970110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.442164898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.442331076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.442348003 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.442389965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.442944050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.442996025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.443315029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.444550991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.444668055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.444703102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.444875956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.444922924 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.445046902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.445065975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.445128918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.446150064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.446316004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.446368933 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.447381020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.447559118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.447581053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.447632074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.448088884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.448303938 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.449362993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.449379921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.449441910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.780821085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.780968904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.781019926 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.782100916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.782119036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.782186985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.782306910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.782375097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.782427073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.783617020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.784722090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.784991026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.785057068 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.786015034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.786091089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.786118984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.786154032 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.786194086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:18.786907911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:18.937623024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.145344019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.146153927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.146174908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.146210909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.146347046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.146394968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.146430016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.146975994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.147020102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.147022009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.147211075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.147810936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.147851944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.148312092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.148360014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.148403883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.148428917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.148471117 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.148971081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.149008989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.149054050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.150693893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.151474953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.151551962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.152368069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.152419090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.152477026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.152518988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.152527094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.152559996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.152647972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.154275894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.154340982 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.155919075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.156034946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.156080008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.156100035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.156611919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.156691074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.157027006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.157139063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.157386065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.157672882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.157748938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.157829046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.158226013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159015894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159085035 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159115076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.159131050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159239054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.159746885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159816027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.159887075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.160608053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.160681963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.160778046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.160810947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.265933990 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.310152054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.311052084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.311103106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.528976917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529005051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529021025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529073000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.529218912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529246092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529292107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.529314995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.529359102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.530284882 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.530307055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.530359030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.530898094 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.530972004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.531018972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.531502008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.531543970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.531656027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.885987997 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.886677980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.886742115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.886807919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.887000084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.887065887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.887886047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.888267040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.888346910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.888787985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.888792992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.889229059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.889257908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.889720917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.889867067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.890975952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.891074896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.891108990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.891208887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.892486095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.892546892 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.892579079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.893002987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.893337965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.894221067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.894294977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.894334078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.894383907 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.895071983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.895226955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.895426989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.895787954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.895950079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.896773100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.896819115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.896899939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.897034883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.897572041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.897722960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.897778988 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.898459911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.898896933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.898977995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.899007082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.899034977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.899214029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.899349928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.899758101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.900110960 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.900269032 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.900437117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.900479078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.900527954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.900794029 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.901202917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.901257992 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.901264906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.901685953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:19.901735067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:19.901767969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.033978939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.246074915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.246146917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.246195078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.246198893 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.246237040 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.246370077 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.246395111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247204065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247257948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.247745037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247813940 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247869968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247911930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.247961998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.248047113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.248878002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.248960972 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.248966932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.364427090 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.597461939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.598274946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.598963976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.599242926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.599303961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.599672079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.599940062 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.600279093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.600781918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.600857973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.600904942 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.601073027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602241993 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602293015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.602313995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602370024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602421999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602463007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.602471113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.603157043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.603199005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.603950024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.603993893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.604053974 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.604202032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.604258060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.604301929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.604341984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.605277061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.605441093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.608937979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.608961105 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.608990908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.609019995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.609050989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.609097958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.609560966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.609576941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.609620094 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.610318899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.610363960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.611464024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.611527920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.611567020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.611573935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.611836910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.611881971 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.611888885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.612374067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.613658905 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.613708019 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.613718987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.614480972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.614584923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.614639044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.614665985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.614680052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.614727020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.614980936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.667191029 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.937731028 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.937778950 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:20.937861919 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.950274944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.950488091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.950642109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.950684071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.950954914 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.951000929 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:20.951212883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.951284885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.951616049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.951700926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.951759100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.951812029 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.951833963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.951898098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.951904058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.952481985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.952531099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.952558994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.952616930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.952634096 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:20.952727079 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:20.955106020 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.955179930 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:20.956080914 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.956878901 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:20.956912041 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.057782888 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.324784994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.325109005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.325123072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.325172901 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.325512886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.325566053 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.327069998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.328881979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.329067945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.329112053 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.329379082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.329442024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.329447985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.329518080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.329561949 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.331007957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.331899881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.331943035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.331971884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.332535982 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.333009958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.333051920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.333285093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.333786011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.334316969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.334676027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.334717035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.334728956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.335350990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.335397005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.335818052 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.336282969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.336352110 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.337858915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.337902069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.337958097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.338004112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.338794947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.338843107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.339123964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.341108084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.341155052 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.341228008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.341311932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.341370106 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.342477083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.343786955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.343839884 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.343890905 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.344062090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.344914913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.344965935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.344997883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.345041037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.345066071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.346096039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.346142054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.347498894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.347552061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.348006964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.363500118 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.363996983 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.364025116 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.365951061 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.366024971 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.370130062 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.370820045 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.370857000 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.372586012 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.372679949 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.374161005 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.374295950 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.374430895 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.374444008 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.376965046 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.377063036 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.432791948 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.432811022 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.464032888 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.542182922 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.697812080 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.698048115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.698113918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.699373007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.699424028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.699491978 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.699496984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.701572895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.701625109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.701637983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.701805115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.702713013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.702755928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.702847958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.703000069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.703043938 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.704869032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.704919100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:21.704978943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:21.855626106 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855701923 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.855736017 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855756998 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855813980 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855817080 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.855843067 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855865955 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855896950 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.855912924 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.855978012 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.869440079 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.869505882 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.869524956 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.869582891 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.883390903 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.883451939 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.897279024 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.897350073 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.897356033 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.897371054 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.897468090 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.911024094 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.911143064 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.911241055 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.911680937 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.911705017 CET	443	49744	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:21.911736965 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:21.911910057 CET	49744	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:22.096002102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.096358061 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.097045898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.097062111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.097120047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.097120047 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.099237919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.099374056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.099390030 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.099428892 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.099720955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.100110054 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.100296021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.100467920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.100519896 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.102056980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.102088928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.102138996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.102247953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.102940083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.102961063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.103012085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.103097916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.103209019 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.104049921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.104226112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.104362965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.104918957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.105065107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.105118036 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.107938051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.108107090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.108376026 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.108450890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.108649969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.108699083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.109057903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109289885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109306097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109322071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109335899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109345913 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.109350920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.109373093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.109391928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.109503984 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.111085892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.111164093 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.112315893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.112459898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.112513065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.113017082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.113037109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.113054037 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.113090992 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.113368034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.113518953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.113567114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.114084959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.114103079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.114147902 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.467849016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.468004942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.468331099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.468394995 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.468868017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.469145060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.469197035 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.469717026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.469826937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.469877958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.469880104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.469924927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.470673084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.470705032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.470824003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.470956087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.470973015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.471033096 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.472384930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.562479973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.823723078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.823796034 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.824007988 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.824069023 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.825160980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.825241089 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.825403929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.825586081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.825644970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.825900078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.826023102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.826073885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.826272011 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.826900005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827358007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827383995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827409029 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.827438116 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.827645063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827733994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827747107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.827792883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.829305887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.829323053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.829354048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.829603910 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.829621077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.829667091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.830094099 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.830223083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.830269098 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.832262039 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.832295895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.832340956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.833007097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.833045959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.833051920 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.833264112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.833307981 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.836508036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.837001085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.837057114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.837419033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.840167999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.840208054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.840256929 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.840681076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.840728045 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.840756893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.841943979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.842003107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.842817068 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.844454050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.844517946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.844567060 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.844710112 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.844765902 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.844825983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.846266985 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.846313953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:22.847384930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:22.956079006 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.196470976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198201895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198257923 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.198340893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198662043 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198712111 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.198905945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198945045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.198991060 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.199136972 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.199729919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.200125933 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.200979948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.200995922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.201035976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.201041937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.201056004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.201114893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.201117992 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.267966986 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.267996073 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.268081903 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.268214941 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.271672964 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.272480011 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.272492886 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.312247992 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.388006926 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.388096094 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.388170004 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.401763916 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.401796103 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.413886070 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.413903952 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.413994074 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.433851004 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.433866978 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505486012 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505585909 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505584955 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.505646944 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505676031 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505722046 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505732059 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.505750895 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505776882 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.505781889 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.505824089 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.505836964 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.519212008 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.520417929 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.520431042 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.529778957 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.529937029 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.529949903 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.543862104 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.543898106 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.543924093 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.543941021 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.544256926 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.552767038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553086996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553137064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553149939 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.553360939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553416014 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.553457975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553472042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.553528070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.554521084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.554559946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.554615974 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.555193901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.555865049 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.555917025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.555919886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.555948973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.556082010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.556670904 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.556684971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.556732893 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.557698965 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.557779074 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.558054924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.558068991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.558082104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.558135986 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.558145046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.558687925 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.558718920 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.559000969 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.559461117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.559509993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.559855938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.559887886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.559945107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.560009003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.560009003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.560081959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.560879946 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.560936928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.561297894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.561317921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.561381102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.561467886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.561569929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.561616898 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.562026024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563479900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563493967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563532114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.563555002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563610077 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563656092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.563718081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.563818932 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.563889980 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.564950943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.564986944 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.565040112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.565123081 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.565171957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.676163912 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.689084053 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.689095020 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.690258026 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.690330029 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.703943968 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.703989029 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.704169035 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.704231977 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.710887909 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.710954905 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.710973024 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.716149092 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.716301918 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.724634886 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.724669933 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.724700928 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.724716902 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.724791050 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.738769054 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.738804102 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.738886118 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.738903046 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.752535105 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.752598047 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.752638102 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.752706051 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.752769947 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.766479015 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.766669035 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.766729116 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.768100023 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.768107891 CET	443	49747	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.780364037 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.780410051 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.780443907 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.780481100 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.780550957 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.793121099 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.793178082 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.804655075 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.805394888 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.805413961 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.805536032 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.805599928 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.805646896 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.806394100 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.806462049 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.808079958 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.808139086 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.818339109 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.818453074 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.818470001 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.818525076 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.830732107 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.830774069 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.830813885 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.830825090 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.839526892 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.840009928 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.840018034 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.841455936 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.841561079 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.842088938 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.842164993 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.843622923 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.843655109 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.843692064 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.843704939 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.843758106 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.861984015 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.862046003 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.862059116 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.862067938 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.862123013 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.902457952 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.902542114 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.907278061 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.907325029 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.907335043 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.907346964 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.907535076 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.912751913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.915081024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.915092945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.915152073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.915168047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.915225983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.915945053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.916400909 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.916445971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.916486979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.917016983 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.917068958 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.917139053 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.917200089 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.919086933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919137955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919147015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.919419050 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919430017 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919441938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919451952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:23.919469118 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.919496059 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:23.925638914 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.925684929 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.925708055 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.925729036 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.925916910 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.934761047 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.934830904 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.934843063 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.943619967 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.943691015 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.943705082 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.952707052 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.952771902 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.952812910 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.952827930 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.952893019 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.955683947 CET	49747	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.955854893 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.955862045 CET	443	49749	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.961576939 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.961638927 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.961694002 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.961707115 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.961780071 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.970493078 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.970593929 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.970716000 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.970729113 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.979585886 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.979635954 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.979652882 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.979667902 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.980745077 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.988631010 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.988749981 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.997478962 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:23.997539997 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:23.997551918 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.002006054 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.002091885 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.002105951 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.011061907 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.011086941 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.011131048 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.011146069 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.011197090 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.012238979 CET	443	49748	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.012285948 CET	49748	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.019906998 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.019972086 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.019993067 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.020011902 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.021240950 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.028928995 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.028997898 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.029083967 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.029098034 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.038053036 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.039608955 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.039622068 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.046926022 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.046969891 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.046983957 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.046998024 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.047096014 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.055876970 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.055933952 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.055944920 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.064667940 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.064732075 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.064750910 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.064804077 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.065062046 CET	49749	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.072870016 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.072941065 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.072962046 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.073020935 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.081285000 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.081360102 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.089133024 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.089173079 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.089194059 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.089210033 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.089319944 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.097486973 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.097554922 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.097636938 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.097687006 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.105036020 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.105101109 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.112999916 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.113028049 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.113076925 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.113104105 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.113261938 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.120841980 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.120903969 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.120965958 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.120975018 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.125751019 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.125804901 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.125813007 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.130628109 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.130678892 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.130690098 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.130697012 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.130749941 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.135512114 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.135562897 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.135567904 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.135576010 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.135628939 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.140403986 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.140484095 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.145236969 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.145308971 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.145322084 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.145380020 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.149995089 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.150059938 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.150079012 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.150130987 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.154771090 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.154939890 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.159434080 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.159492970 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.159528017 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.159537077 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.159615993 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.164136887 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.164186954 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.168549061 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.173163891 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.173208952 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.174128056 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.174134970 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.174227953 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.177571058 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.177618027 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.177684069 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.177691936 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.177786112 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.182137966 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.182249069 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.186492920 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.186546087 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.186557055 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.186563015 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.186604023 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.190754890 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.190803051 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.190819979 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.190826893 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.190870047 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.195066929 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.195125103 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.195147991 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.195153952 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.195312023 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.199559927 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.199646950 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.203574896 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.203618050 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.203641891 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.203650951 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.203720093 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.207781076 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.207859039 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.207900047 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.207967997 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.212044001 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.212122917 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.216136932 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.216236115 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.216268063 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.216347933 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.220292091 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.220385075 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.220402956 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.220410109 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.220514059 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.224155903 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.224266052 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.228246927 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.228305101 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.228319883 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.228373051 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.232198954 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.232248068 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.232258081 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.232311010 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.236183882 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.236242056 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.236310959 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.236318111 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.240195036 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.240303040 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.240310907 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.243967056 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.244036913 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.244044065 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.244108915 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.244204044 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.244210005 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.247966051 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.248019934 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.248059034 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.248074055 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.248147011 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.251817942 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.251909971 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.255553961 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.255610943 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.255649090 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.255662918 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.255753040 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.259316921 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.259388924 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.259443998 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.259457111 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.259569883 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.263467073 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.263549089 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.266962051 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.267026901 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.267030954 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.267044067 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.267087936 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.267317057 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.269575119 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.269635916 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.269720078 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.270668030 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.270718098 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.270730972 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.270745039 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.271138906 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.273958921 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.273994923 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.274410963 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.274466991 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.275203943 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.275240898 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.275640011 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.276067972 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.276096106 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.278186083 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.278228998 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.278245926 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.278259039 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.278431892 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.281795979 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.281840086 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.281857967 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.281871080 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.281932116 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.284830093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285012007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285098076 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285098076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.285151005 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285218000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285260916 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.285348892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.285486937 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.285552025 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.285648108 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.286353111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.286492109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.286570072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.286586046 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.286598921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.286662102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.286941051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.287025928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.287091970 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.287103891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288126945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288175106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288253069 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288263083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.288330078 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.288522959 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288641930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.288738966 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.288836956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.289017916 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.289082050 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.289086103 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.289098978 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.289207935 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.289813042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.289896965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.289941072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.289978027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.290069103 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.290117979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.290602922 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.290678024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.290716887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.291475058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.291541100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.291589975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.291659117 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.291726112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.291954041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.292324066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.292360067 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.292432070 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.292504072 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.292543888 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.292577028 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.292588949 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.292694092 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.292728901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.292839050 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.293252945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.293565989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.293603897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.293628931 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.294059992 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.294131994 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.294164896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.294900894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.294944048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.294967890 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.295358896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.295398951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.295461893 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.296020985 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.296091080 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.299554110 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.299612999 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.299635887 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.299685955 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.303111076 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.303159952 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.303369999 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.303376913 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.303426027 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.306569099 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.306637049 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.310098886 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.310187101 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.310264111 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.310318947 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.313580990 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.313678026 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.313735962 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.331024885 CET	49745	443	192.168.2.4	31.13.65.49
Mar 10, 2024 17:31:24.331056118 CET	443	49745	31.13.65.49	192.168.2.4
Mar 10, 2024 17:31:24.455704927 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.602536917 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.606206894 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.630765915 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.630793095 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.631794930 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.631808043 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.632375956 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.632476091 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.635070086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.635368109 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.635468006 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.635521889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.635632038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.635693073 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.635793924 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.635940075 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.635957003 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.636061907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.636380911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.636444092 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.636789083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.637950897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.638056993 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.638094902 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.638168097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.638205051 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.638293982 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.638350010 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.638577938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.638742924 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.638756990 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.639307976 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.639374971 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.639414072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.639801979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.639874935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.768095016 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.840301037 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.842891932 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.945333958 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.945362091 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.945415020 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.945452929 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.946204901 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.946204901 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.946424007 CET	49751	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:24.946434021 CET	443	49751	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:24.946913004 CET	49752	443	192.168.2.4	162.159.61.3
Mar 10, 2024 17:31:24.946916103 CET	443	49752	162.159.61.3	192.168.2.4
Mar 10, 2024 17:31:24.996433020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.996455908 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.996522903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.996784925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.997525930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.997570038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.997874022 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.998184919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.998231888 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.998970032 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.999047041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:24.999113083 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:24.999594927 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.000586033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.000636101 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.000967026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.001488924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.001542091 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.002382994 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.002707958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.002731085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.003237009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.003305912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.003957987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.004595041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.005768061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.005793095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.005840063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.007215977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.008842945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.008912086 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.008960009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.009411097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.009742975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.009785891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.011109114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.011126041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.012074947 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.012084007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.012945890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.013010979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.013179064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.013221025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.014754057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.014775038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.014827013 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.014900923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.015533924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.015594959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.015984058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.016025066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.016241074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.016948938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.017060995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.017122030 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.017249107 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.018090010 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.018146038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.018425941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.064979076 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.344594002 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.344907045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.345484018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.345556021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.345650911 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.345679998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.345727921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.345786095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.348834038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349486113 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349539995 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349611998 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.349746943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349796057 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349817038 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.349921942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.349992037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.350208998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.350285053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.350502968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.747731924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.748356104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.748409986 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.748991966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749008894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749058962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.749118090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749676943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749694109 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749731064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.749890089 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.749934912 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.750588894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.750606060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.750653028 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.750675917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.750782967 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.750874996 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.751597881 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752108097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752124071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752159119 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.752383947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752401114 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752468109 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.752513885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.752933979 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.753295898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.753312111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.753360033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.753741026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.753757954 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.753806114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.754355907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.754374027 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.754422903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.754797935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.755373955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.755553007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.755590916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.755603075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.755846977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.755932093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.756010056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.756432056 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.756479025 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.757312059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.757329941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.757375956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.757463932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.757507086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.757566929 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.757622004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.757667065 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.758285999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.758801937 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.758928061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.759156942 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.759176016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.759232044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:25.759828091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:25.955591917 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.101938963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.102020025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.102063894 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.102134943 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.102166891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.102247000 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.102287054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103204966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103281021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.103318930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103353977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103423119 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103478909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.103902102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103940964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.103965044 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.104386091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.104422092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.104494095 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.478312016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.478519917 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.478602886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.478668928 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.478688955 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.478720903 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.479141951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.479671955 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.479933977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.480695963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.480731964 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.480793953 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.480885983 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.480925083 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.480976105 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.481425047 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.482794046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.482830048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.482889891 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.483400106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.483526945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.483563900 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.483584881 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.483604908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.484261990 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.485502958 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.485552073 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.485615015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.485743046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.485775948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.485785961 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.486139059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.486182928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.486303091 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.487034082 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.487080097 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.487296104 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.487441063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.487514973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.487565041 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.488468885 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.488485098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.488531113 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.488692045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.488735914 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.489130974 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.489146948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.489191055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.489203930 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.489541054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.489758968 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.490164042 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.490222931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.490266085 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.490530014 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.490607977 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.490654945 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.490673065 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.491699934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.491743088 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.492758989 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.557019949 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.600589037 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.828242064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.828389883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.828650951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.828896999 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.828948021 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.829714060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.830246925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.830296040 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.831408024 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.831485987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.834117889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.834170103 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.834955931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.835011005 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.835552931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.835599899 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.835648060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.835694075 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.835916996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.835956097 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.835963011 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.835999012 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.836144924 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.836183071 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:26.836229086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:26.836241007 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.041593075 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.187648058 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.188616991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.188672066 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.188671112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.188733101 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.188874960 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.189043045 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.189264059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.189322948 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.189429998 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.190270901 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.190315962 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.190474033 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.190495968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.190531969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.191416979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.191598892 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.191646099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.191684008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.191816092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.191857100 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.192179918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.192286015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.192497969 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.192779064 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.193079948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.193135023 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.193147898 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.193418026 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.193469048 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.194291115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.194351912 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.194515944 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.194921970 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.195231915 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.195292950 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.195300102 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.195429087 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.195487976 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.195904016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.195945978 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.196213007 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.196576118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.196945906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.196984053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.197017908 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.197662115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.197724104 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.197737932 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.197757006 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.197802067 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.197917938 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.199124098 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.199182987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.199182987 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.199239016 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.199635029 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.199805021 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.200905085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.200963020 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.201006889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.348037958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.409914017 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.409921885 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.409957886 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.409961939 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.410037994 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.410115957 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.410566092 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.410587072 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.410964966 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.410979033 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.543916941 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.544495106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.544560909 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.544709921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.545469046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.545522928 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.545563936 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.545600891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.545638084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.545650959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.546149015 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.546211958 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.546261072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.547096968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.547162056 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.547705889 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.547741890 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.547777891 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.547844887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.625556946 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.728754044 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:27.728777885 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:27.729226112 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:27.729665995 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:27.729676008 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:27.762940884 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.763207912 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.763242006 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.764625072 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.765007019 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.765017033 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.765033960 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.765088081 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.766483068 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.766489983 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.766547918 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.766575098 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.767170906 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.767249107 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.869513035 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.869530916 CET	443	49757	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:27.899483919 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.899591923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.899661064 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.899740934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.900823116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.900861979 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.900901079 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.900918007 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.900994062 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.900998116 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.901308060 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.901345968 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.901372910 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.902367115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.902406931 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.902431965 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.902478933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.902546883 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.902936935 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.902978897 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.903059959 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.903637886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.903820038 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.903892040 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.904627085 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.904669046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.904762983 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.905127048 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.905278921 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.905428886 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.905452013 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.906303883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.906389952 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.906481981 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.906577110 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.906636953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.906681061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.907237053 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.907274961 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.907308102 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.907845020 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.908257008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.908293962 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.908325911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.908380985 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.908814907 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.909466028 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.909528017 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.909847975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.909904957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.910000086 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.910681963 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.910788059 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.910859108 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.911171913 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.911209106 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.911278009 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.911657095 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.911695004 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:27.911776066 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:27.947654963 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:27.947680950 CET	443	49756	172.64.41.3	192.168.2.4
Mar 10, 2024 17:31:28.057025909 CET	49757	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:28.133445978 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.134974957 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.134984970 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.135148048 CET	49756	443	192.168.2.4	172.64.41.3
Mar 10, 2024 17:31:28.135493040 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.135791063 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.136497021 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.136614084 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.137697935 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.137773991 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.138051033 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.138056040 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.138079882 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.184231043 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.244792938 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.281236887 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.281446934 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.281491041 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.281507015 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.281791925 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.281853914 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.281904936 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.281999111 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.282048941 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.282578945 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.283410072 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.283463001 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.283777952 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.283840895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.283878088 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.283915997 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.283962965 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.284043074 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.284670115 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.369509935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.470978022 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.643188000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.643296003 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.643321991 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.643364906 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.643402100 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.643419027 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.643471956 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.643826008 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.643893957 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.644380093 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.644423008 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.645271063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.645308971 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.645351887 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.645365000 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.645405054 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.645442009 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.645450115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.647017956 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.647068024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.647573948 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.647629023 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.647708893 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.647753954 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.648004055 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.648138046 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.648183107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.649714947 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.649787903 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.649833918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.649878025 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.649919987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.649975061 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.650369883 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.650425911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.651048899 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.651086092 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.651137114 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.651396036 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.651436090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.651835918 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.651885033 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.652057886 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.652770996 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.652807951 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.652827024 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.652856112 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.653913975 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.654012918 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.654016018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.654053926 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.654090881 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.654117107 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.654655933 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.654757977 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.655134916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.655181885 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.655375957 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.655451059 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.655838966 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.655885935 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.655926943 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.655973911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.655996084 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.656042099 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.657185078 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.657906055 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.708667040 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708726883 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708746910 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708765030 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708775997 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.708794117 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708800077 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.708812952 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.708837986 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708856106 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708873987 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708887100 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.708897114 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.708909988 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.708924055 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.709124088 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709161997 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709173918 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.709187984 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709209919 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709212065 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.709235907 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709270954 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.709275961 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.709297895 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.878629923 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.901149988 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901200056 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901225090 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.901266098 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.901267052 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901946068 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901966095 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901987076 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.901998997 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902012110 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902040958 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902060032 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902080059 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902097940 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902111053 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902122974 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902132034 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902143002 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902833939 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902853012 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902890921 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902894020 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902915955 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902921915 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902941942 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.902964115 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.902991056 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.903882980 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.903924942 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.903942108 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.903950930 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.904006958 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.904012918 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:28.947624922 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:28.990474939 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.991235018 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.991271973 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.991288900 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.992412090 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.992450953 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.992465973 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.993422031 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.993511915 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.993669987 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.993707895 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.993743896 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.993789911 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.995417118 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.995476007 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.995513916 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.995520115 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:28.995552063 CET	15762	49734	209.25.140.212	192.168.2.4
Mar 10, 2024 17:31:28.995620012 CET	49734	15762	192.168.2.4	209.25.140.212
Mar 10, 2024 17:31:29.093553066 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.093578100 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.093620062 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.093631029 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.093647003 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.093681097 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.093691111 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.093904972 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.094307899 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.094351053 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.094373941 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.094381094 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.094408035 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.094425917 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.095247030 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.095289946 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.095313072 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.095318079 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.095347881 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.095360041 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096025944 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096067905 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096108913 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096116066 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096124887 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096154928 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096801996 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096843958 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096864939 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096873045 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.096903086 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.096915960 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.097984076 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098027945 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098053932 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.098058939 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098087072 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.098107100 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.098742008 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098783970 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098802090 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.098807096 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.098835945 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.098846912 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.104768991 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.285969019 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.286027908 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.286067963 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.286079884 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.286125898 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.286139965 CET	49758	443	192.168.2.4	20.118.82.167
Mar 10, 2024 17:31:29.286461115 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.286504984 CET	443	49758	20.118.82.167	192.168.2.4
Mar 10, 2024 17:31:29.286523104 CET	49758	443	192.168.2.4	20.118.82.167

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2024 17:30:43.607501984 CET	192.168.2.4	1.1.1.1	0x9804	Standard query (0)	title-formula.at.ply.gg	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:02.327569008 CET	192.168.2.4	1.1.1.1	0xe748	Standard query (0)	botmaster.mediaplus.me	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:20.777764082 CET	192.168.2.4	1.1.1.1	0x586d	Standard query (0)	web.whatsapp.com	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:20.778539896 CET	192.168.2.4	1.1.1.1	0x528e	Standard query (0)	web.whatsapp.com	65	IN (0x0001)	false
Mar 10, 2024 17:31:20.782217979 CET	192.168.2.4	1.1.1.1	0x2d9d	Standard query (0)	web.whatsapp.com	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.112807035 CET	192.168.2.4	1.1.1.1	0xa0dc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.113374949 CET	192.168.2.4	1.1.1.1	0xe592	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Mar 10, 2024 17:31:24.114272118 CET	192.168.2.4	1.1.1.1	0x23de	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.119498968 CET	192.168.2.4	1.1.1.1	0x4436	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2024 17:30:43.789243937 CET	1.1.1.1	192.168.2.4	0x9804	No error (0)	title-formula.at.ply.gg		209.25.140.212	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:02.562602043 CET	1.1.1.1	192.168.2.4	0xe748	No error (0)	botmaster.mediaplus.me		173.248.130.117	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:20.932476997 CET	1.1.1.1	192.168.2.4	0x586d	No error (0)	web.whatsapp.com	mmx-ds.cdn.whatsapp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2024 17:31:20.932476997 CET	1.1.1.1	192.168.2.4	0x586d	No error (0)	mmx-ds.cdn.whatsapp.net		31.13.65.49	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:20.933118105 CET	1.1.1.1	192.168.2.4	0x528e	No error (0)	web.whatsapp.com	mmx-ds.cdn.whatsapp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2024 17:31:20.937690973 CET	1.1.1.1	192.168.2.4	0x2d9d	No error (0)	web.whatsapp.com	mmx-ds.cdn.whatsapp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2024 17:31:20.937690973 CET	1.1.1.1	192.168.2.4	0x2d9d	No error (0)	mmx-ds.cdn.whatsapp.net		31.13.65.49	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.267573118 CET	1.1.1.1	192.168.2.4	0xa0dc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.267573118 CET	1.1.1.1	192.168.2.4	0xa0dc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.268357992 CET	1.1.1.1	192.168.2.4	0xe592	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Mar 10, 2024 17:31:24.268976927 CET	1.1.1.1	192.168.2.4	0x23de	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.268976927 CET	1.1.1.1	192.168.2.4	0x23de	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Mar 10, 2024 17:31:24.274208069 CET	1.1.1.1	192.168.2.4	0x4436	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	173.248.130.117	80	3736	C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe

Timestamp	Bytes transferred	Direction	Data
Mar 10, 2024 17:31:02.797898054 CET	133	OUT	GET /api/v2/getwapi.ashx?key=Ju9SWyJu9WQwgnmtZo7m2meGaJg8ciMVZGByC HTTP/1.1 Host: botmaster.mediaplus.me Connection: Keep-Alive
Mar 10, 2024 17:31:02.985215902 CET	1286	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 10 Mar 2024 16:31:00 GMT Content-Length: 474879 Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 77 70 70 63 6f 6e 6e 65 63 74 2d 77 61 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 2e 57 50 50 3d 74 28 29 3a 65 2e 57 50 50 3d 74 28 29 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 37 39 37 34 32 3a 28 65 2c 74 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 62 79 74 65 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 61 28 65 29 2c 72 3d 74 5b 30 5d 2c 6e 3d 74 5b 31 5d 3b 72 65 74 75 72 6e 20 33 2a 28 72 2b 6e 29 2f 34 2d 6e 7d 2c 74 2e 74 6f 42 79 74 65 41 72 72 61 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 69 3d 61 28 65 29 2c 73 3d 69 5b 30 5d 2c 75 3d 69 5b 31 5d 2c 63 3d 6e 65 77 20 6f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 33 2a 28 74 2b 72 29 2f 34 2d 72 7d 28 30 2c 73 2c 75 29 29 2c 6c 3d 30 2c 64 3d 75 3e 30 3f 73 2d 34 3a 73 3b 66 6f 72 28 72 3d 30 3b 72 3c 64 3b 72 2b 3d 34 29 74 3d 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 5d 3c 3c 31 38 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 5d 3c 3c 31 32 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 32 29 5d 3c 3c 36 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 33 29 5d 2c 63 5b 6c 2b 2b 5d 3d 74 3e 3e 31 36 26 32 35 35 2c 63 5b 6c 2b 2b 5d 3d 74 3e 3e 38 26 32 35 35 2c 63 5b 6c 2b 2b 5d 3d 32 35 35 26 74 3b 72 65 74 75 72 6e 20 32 3d 3d 3d 75 26 26 28 74 3d 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 5d 3c 3c 32 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 5d 3e 3e 34 2c 63 5b 6c 2b 2b 5d 3d 32 35 35 26 74 29 2c 31 3d 3d 3d 75 26 26 28 74 3d 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 5d 3c 3c 31 30 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 5d 3c 3c 34 7c 6e 5b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 32 29 5d 3e 3e 32 2c 63 5b 6c 2b 2b 5d 3d 74 3e 3e 38 26 32 35 35 2c 63 5b 6c 2b 2b 5d 3d 32 35 35 26 74 29 2c 63 7d 2c 74 2e 66 72 6f 6d 42 79 74 65 41 72 72 61 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 25 33 2c 69 3d 5b 5d 2c 73 3d 31 36 33 38 33 2c 61 3d 30 2c 63 3d 6e 2d 6f 3b 61 3c 63 3b 61 2b 3d 73 29 69 2e 70 75 73 68 28 75 28 65 2c 61 2c 61 2b 73 3e 63 3f 63 3a 61 2b 73 29 29 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 6f 3f 28 74 3d 65 5b 6e 2d 31 5d 2c 69 2e 70 75 73 68 28 72 5b 74 3e 3e 32 5d 2b 72 5b 74 3c 3c 34 26 36 33 5d 2b 22 3d 3d 22 29 29 3a 32 3d 3d 3d 6f 26 26 28 74 3d 28 65 5b 6e 2d 32 5d 3c 3c 38 29 2b 65 5b Data Ascii: /! For license information please see wppconnect-wa.js.LICENSE.txt /!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.WPP=t():e.WPP=t()}(self,(()=>(()=>{var __webpack_modules__={79742:(e,t)=>{"use strict";t.byteLength=function(e){var t=a(e),r=t[0],n=t[1];return 3(r+n)/4-n},t.toByteArray=function(e){var t,r,i=a(e),s=i[0],u=i[1],c=new o(function(e,t,r){return 3(t+r)/4-r}(0,s,u)),l=0,d=u>0?s-4:s;for(r=0;r<d;r+=4)t=n[e.charCodeAt(r)]<<18\|n[e.charCodeAt(r+1)]<<12\|n[e.charCodeAt(r+2)]<<6\|n[e.charCodeAt(r+3)],c[l++]=t>>16&255,c[l++]=t>>8&255,c[l++]=255&t;return 2===u&&(t=n[e.charCodeAt(r)]<<2\|n[e.charCodeAt(r+1)]>>4,c[l++]=255&t),1===u&&(t=n[e.charCodeAt(r)]<<10\|n[e.charCodeAt(r+1)]<<4\|n[e.charCodeAt(r+2)]>>2,c[l++]=t>>8&255,c[l++]=255&t),c},t.fromByteArray=function(e){for(var t,n=e.length,o=n%3,i=[],s=16383,a=0,c=n-o;a<c;a+=s)i.push(u(e,a,a+s>c?c:a+s));return 1===o?(t=e[n-1],i.push(r[t>>2]+r[t<<4&63]+"==")):2===o&&(t=(e[n-2]<<8)+e[
Mar 10, 2024 17:31:02.985253096 CET	1286	IN	Data Raw: 6e 2d 31 5d 2c 69 2e 70 75 73 68 28 72 5b 74 3e 3e 31 30 5d 2b 72 5b 74 3e 3e 34 26 36 33 5d 2b 72 5b 74 3c 3c 32 26 36 33 5d 2b 22 3d 22 29 29 2c 69 2e 6a 6f 69 6e 28 22 22 29 7d 3b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 2c 6e 3d 5b 5d 2c 6f 3d 22 Data Ascii: n-1],i.push(r[t>>10]+r[t>>4&63]+r[t<<2&63]+"=")),i.join("")};for(var r=[],n=[],o="undefined"!=typeof Uint8Array?Uint8Array:Array,i="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",s=0;s<64;++s)r[s]=i[s],n[i.charCodeAt(s)]=s;f
Mar 10, 2024 17:31:02.985270023 CET	1286	IN	Data Raw: 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 55 6e 6b 6e 6f 77 6e 20 65 6e 63 6f 64 69 6e 67 3a 20 22 2b 74 29 3b 63 6f 6e 73 74 20 72 3d 30 7c 6d 28 65 2c 74 29 3b 6c 65 74 20 6e 3d 61 28 72 29 3b 63 6f 6e 73 74 20 6f Data Ascii: t))throw new TypeError("Unknown encoding: "+t);const r=0\|m(e,t);let n=a(r);const o=n.write(e,t);return o!==r&&(n=n.slice(0,o)),n}(e,t);if(ArrayBuffer.isView(e))return function(e){if(H(e,Uint8Array)){const t=new Uint8Array(e);return p(t.buffer,
Mar 10, 2024 17:31:02.985306025 CET	1286	IN	Data Raw: 2c 20 41 72 72 61 79 42 75 66 66 65 72 2c 20 41 72 72 61 79 2c 20 6f 72 20 41 72 72 61 79 2d 6c 69 6b 65 20 4f 62 6a 65 63 74 2e 20 52 65 63 65 69 76 65 64 20 74 79 70 65 20 22 2b 74 79 70 65 6f 66 20 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 Data Ascii: , ArrayBuffer, Array, or Array-like Object. Received type "+typeof e)}function l(e){if("number"!=typeof e)throw new TypeError('"size" argument must be of type number');if(e<0)throw new RangeError('The value "'+e+'" is invalid for option "size"
Mar 10, 2024 17:31:03.170409918 CET	1286	IN	Data Raw: 66 2d 38 22 3a 72 65 74 75 72 6e 20 24 28 65 29 2e 6c 65 6e 67 74 68 3b 63 61 73 65 22 75 63 73 32 22 3a 63 61 73 65 22 75 63 73 2d 32 22 3a 63 61 73 65 22 75 74 66 31 36 6c 65 22 3a 63 61 73 65 22 75 74 66 2d 31 36 6c 65 22 3a 72 65 74 75 72 6e Data Ascii: f-8":return $(e).length;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return 2*r;case"hex":return r>>>1;case"base64":return K(e).length;default:if(o)return n?-1:$(e).length;t=(""+t).toLowerCase(),o=!0}}function y(e,t,r){let n=!1;if((void
Mar 10, 2024 17:31:03.170433998 CET	1286	IN	Data Raw: 6c 61 73 74 49 6e 64 65 78 4f 66 2e 63 61 6c 6c 28 65 2c 74 2c 72 29 3a 76 28 65 2c 5b 74 5d 2c 72 2c 6e 2c 6f 29 3b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 76 61 6c 20 6d 75 73 74 20 62 65 20 73 74 72 69 6e 67 2c 20 6e 75 Data Ascii: lastIndexOf.call(e,t,r):v(e,[t],r,n,o);throw new TypeError("val must be string, number or Buffer")}function v(e,t,r,n,o){let i,s=1,a=e.length,u=t.length;if(void 0!==n&&("ucs2"===(n=String(n).toLowerCase())\|\|"ucs-2"===n\|\|"utf16le"===n\|\|"utf-16l
Mar 10, 2024 17:31:03.170453072 CET	1286	IN	Data Raw: 79 28 65 29 3a 6e 2e 66 72 6f 6d 42 79 74 65 41 72 72 61 79 28 65 2e 73 6c 69 63 65 28 74 2c 72 29 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 65 2c 74 2c 72 29 7b 72 3d 4d 61 74 68 2e 6d 69 6e 28 65 2e 6c 65 6e 67 74 68 2c 72 29 3b 63 6f 6e 73 74 20 Data Ascii: y(e):n.fromByteArray(e.slice(t,r))}function S(e,t,r){r=Math.min(e.length,r);const n=[];let o=t;for(;o<r;){const t=e[o];let i=null,s=t>239?4:t>223?3:t>191?2:1;if(o+s<=r){let r,n,a,u;switch(s){case 1:t<128&&(i=t);break;case 2:r=e[o+1],128==(192&
Mar 10, 2024 17:31:03.170469999 CET	1286	IN	Data Raw: 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 75 2e 70 72 6f 74 6f 74 79 70 65 2c 22 70 61 72 65 6e 74 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 2e 69 73 42 75 66 66 65 72 28 74 Data Ascii: .defineProperty(u.prototype,"parent",{enumerable:!0,get:function(){if(u.isBuffer(this))return this.buffer}}),Object.defineProperty(u.prototype,"offset",{enumerable:!0,get:function(){if(u.isBuffer(this))return this.byteOffset}}),u.poolSize=8192
Mar 10, 2024 17:31:03.170485973 CET	1286	IN	Data Raw: 31 7d 7d 2c 75 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 22 6c 69 73 74 22 20 61 72 67 75 6d 65 Data Ascii: 1}},u.concat=function(e,t){if(!Array.isArray(e))throw new TypeError('"list" argument must be an Array of Buffers');if(0===e.length)return u.alloc(0);let r;if(void 0===t)for(t=0,r=0;r<e.length;++r)t+=e[r].length;const n=u.allocUnsafe(t);let o=0
Mar 10, 2024 17:31:03.170502901 CET	1286	IN	Data Raw: 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 3d 75 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2c 75 2e 70 72 6f 74 6f 74 79 70 65 2e 65 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 75 2e 69 73 42 75 66 66 65 72 28 Data Ascii: toLocaleString=u.prototype.toString,u.prototype.equals=function(e){if(!u.isBuffer(e))throw new TypeError("Argument must be a Buffer");return this===e\|\|0===u.compare(this,e)},u.prototype.inspect=function(){let e="";const r=t.h2;return e=this.to
Mar 10, 2024 17:31:03.170519114 CET	1286	IN	Data Raw: 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 74 3d 30 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 3d 3d 3d 72 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 6e 3d 74 2c 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 74 3d 30 3b 65 6c 73 Data Ascii: r=this.length,t=0;else if(void 0===r&&"string"==typeof t)n=t,r=this.length,t=0;else{if(!isFinite(t))throw new Error("Buffer.write(string, encoding, offset[, length]) is no longer supported");t>>>=0,isFinite(r)?(r>>>=0,void 0===n&&(n="utf8")):(

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49744	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:21 UTC	714	OUT	GET / HTTP/1.1 Host: web.whatsapp.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-03-10 16:31:21 UTC	1996	IN	HTTP/1.1 200 OK Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding, User-Agent, Accept-Language Vary: Accept-Encoding reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.whatsapp.com/whatsapp_browser_error_reports/?device_level=unknown", permissions_policy="https://www.whatsapp.com/whatsapp_browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.whatsapp.com\/whatsapp_browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.whatsapp.com\/whatsapp_browser_error_reports\/"}],"group":"permissions_policy"} document-policy: force-load-at-top permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: unsafe-none;report-to="coop_report" Pragma: no-cache Cache-Control: no-cache Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0
2024-03-10 16:31:21 UTC	1768	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 73 65 6c 66 27 3b 0d 0a 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 3b 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 77 68 61 74 73 61 70 70 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 3b 73 74 79 6c 65 2d 73 72 63 Data Ascii: content-security-policy: frame-ancestors 'self';content-security-policy: default-src 'self' data: blob:;script-src 'self' data: blob: 'unsafe-eval' 'unsafe-inline' https://static.whatsapp.net https://maps.googleapis.com https://www.youtube.com;style-src
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 64 69 72 3d 22 6c 74 72 22 20 6c 6f 63 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 57 68 61 74 73 41 70 70 20 57 65 62 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e Data Ascii: <!DOCTYPE html><html class="no-js" dir="ltr" loc="en-GB"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><title>WhatsApp Web</title><meta name="viewport" content="width=device-width"><meta name="google" content="n
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 37 2c 20 32 33 39 2c 20 30 2e 38 38 29 3b 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 6c 69 67 68 74 65 72 3a 23 36 36 37 37 38 31 3b 2d 2d 70 72 6f 67 72 65 73 73 2d 70 72 69 6d 61 72 79 3a 23 30 62 38 34 36 64 3b 2d 2d 70 72 6f 67 72 65 73 73 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 33 33 31 33 38 7d 23 61 70 70 2c 62 6f 64 79 2c 68 74 6d 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 23 61 70 70 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 7d 23 69 6e 69 74 69 61 6c 5f 73 74 61 72 74 75 70 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 64 69 Data Ascii: 7, 239, 0.88);--secondary-lighter:#667781;--progress-primary:#0b846d;--progress-background:#233138}#app,body,html{width:100%;height:100%;padding:0;margin:0;overflow:hidden}#app{position:absolute;top:0;left:0}#initial_startup{position:fixed;top:0;left:0;di
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 31 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 6c 69 67 68 74 65 72 29 7d 23 69 6e 69 74 69 61 6c 5f 73 74 61 72 74 75 70 20 2e 73 65 63 6f 6e 64 61 72 79 20 73 70 61 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 70 72 6f 67 72 65 73 73 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 33 70 78 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 6f 67 72 65 73 73 2d 70 72 69 6d 61 72 79 29 3b Data Ascii: 12px;font-size:14px;color:var(--secondary-lighter)}#initial_startup .secondary span{display:inline-block;margin-bottom:2px;vertical-align:middle}progress{-webkit-appearance:none;appearance:none;width:100%;height:3px;margin:0;color:var(--progress-primary);
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 2d 34 2e 34 2d 32 2e 31 2d 2e 36 2d 2e 32 2d 31 2d 2e 34 2d 31 2e 34 2e 33 6c 2d 32 20 32 2e 35 63 2d 2e 34 2e 34 2d 2e 38 2e 35 2d 31 2e 35 2e 32 2d 2e 36 2d 2e 33 2d 32 2e 37 2d 31 2d 35 2e 31 2d 33 2e 32 2d 32 2d 31 2e 37 2d 33 2e 32 2d 33 2e 38 2d 33 2e 36 2d 34 2e 35 2d 2e 34 2d 2e 36 20 30 2d 31 20 2e 33 2d 31 2e 33 6c 31 2d 31 2e 31 2e 36 2d 31 2e 31 63 2e 32 2d 2e 34 20 30 2d 2e 38 20 30 2d 31 2e 31 6c 2d 32 2d 34 2e 38 63 2d 2e 36 2d 31 2e 33 2d 31 2e 31 2d 31 2d 31 2e 35 2d 31 2e 31 68 2d 31 2e 32 63 2d 2e 35 20 30 2d 31 2e 32 2e 31 2d 31 2e 38 2e 38 2d 2e 35 2e 36 2d 32 2e 32 20 32 2e 32 2d 32 2e 32 20 35 2e 33 20 30 20 33 2e 32 20 32 2e 33 20 36 2e 33 20 32 2e 36 20 36 2e 37 2e 33 2e 34 20 34 2e 36 20 37 20 31 31 20 39 2e 37 6c 33 2e 37 20 31 Data Ascii: -4.4-2.1-.6-.2-1-.4-1.4.3l-2 2.5c-.4.4-.8.5-1.5.2-.6-.3-2.7-1-5.1-3.2-2-1.7-3.2-3.8-3.6-4.5-.4-.6 0-1 .3-1.3l1-1.1.6-1.1c.2-.4 0-.8 0-1.1l-2-4.8c-.6-1.3-1.1-1-1.5-1.1h-1.2c-.5 0-1.2.1-1.8.8-.5.6-2.2 2.2-2.2 5.3 0 3.2 2.3 6.3 2.6 6.7.3.4 4.6 7 11 9.7l3.7 1
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 38 35 32 34 62 30 31 22 3e 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 32 34 20 57 68 61 74 73 41 70 70 20 49 6e 63 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 77 68 61 74 73 61 70 70 5f 77 65 62 5f 63 6c 69 65 6e 74 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 77 68 61 74 73 61 70 70 5f 77 65 62 5f 63 6c 69 65 6e 74 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 36 31 37 5d 2c 7b 33 30 37 39 31 34 3a 65 3d 3e 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 7d 2c 35 39 35 33 31 38 3a 65 3d 3e 7b 65 2e 65 78 70 6f 72 74 Data Ascii: 8524b01">/! Copyright (c) 2024 WhatsApp Inc. All Rights Reserved. /(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[5617],{307914:e=>{e.exports=function(e){return e&&e.__esModule?e:{default:e}}},595318:e=>{e.export
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 72 73 69 6f 6e 3a 72 2c 62 72 6f 77 73 65 72 3a 6e 2c 64 65 76 69 63 65 3a 6f 7d 3d 65 3b 72 65 74 75 72 6e 20 74 3d 22 57 65 62 2f 22 2b 6e 2c 60 57 68 61 74 73 41 70 70 2f 24 7b 72 7d 20 24 7b 74 7d 20 44 65 76 69 63 65 2f 24 7b 6f 7d 60 7d 2c 6e 28 72 28 34 37 32 35 31 34 29 29 2c 6e 28 72 28 35 35 36 38 36 39 29 29 7d 2c 37 39 34 38 35 38 3a 28 65 2c 74 2c 72 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 39 35 33 31 38 29 2c 6f 3d 6e 28 72 28 36 37 30 39 38 33 29 29 2c 61 3d 72 28 35 30 38 32 34 37 29 2c 73 3d 72 28 32 35 30 34 37 33 29 2c 63 3d 72 28 32 30 37 30 32 34 29 2c 5f 3d 6e 28 72 28 31 37 34 32 38 35 29 29 2c 75 3d 72 28 34 32 35 30 31 37 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 21 66 75 6e 63 74 69 6f Data Ascii: rsion:r,browser:n,device:o}=e;return t="Web/"+n,`WhatsApp/${r} ${t} Device/${o}`},n(r(472514)),n(r(556869))},794858:(e,t,r)=>{"use strict";var n=r(595318),o=n(r(670983)),a=r(508247),s=r(250473),c=r(207024),_=n(r(174285)),u=r(425017);function i(e){!functio
2024-03-10 16:31:21 UTC	1500	IN	Data Raw: 61 74 20 5b 24 7b 6e 7d 3a 24 7b 72 7d 5d 60 2c 73 74 61 63 6b 3a 22 22 7d 29 29 2c 21 31 29 7d 29 3b 63 6f 6e 73 74 20 64 3d 7b 55 4e 4b 4e 4f 57 4e 5f 49 44 3a 61 2e 55 4e 4b 4e 4f 57 4e 5f 49 44 7d 2c 66 3d 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 4d 61 63 69 6e 74 6f 73 68 3b 20 49 6e 74 65 6c 20 4d 61 63 20 4f 53 20 58 20 31 30 5f 31 30 5f 31 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 31 31 33 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 3b 6c 65 74 20 70 7d 2c 34 32 35 30 31 37 3a 28 65 2c 74 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 63 Data Ascii: at [${n}:${r}]`,stack:""})),!1)});const d={UNKNOWN_ID:a.UNKNOWN_ID},f="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36";let p},425017:(e,t)=>{"use strict";function r(e){return e.inc
2024-03-10 16:31:21 UTC	1200	IN	Data Raw: 5f 4f 52 49 47 49 4e 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 2e 77 68 61 74 73 61 70 70 2e 63 6f 6d 2f 22 2c 74 2e 57 53 5f 4f 52 49 47 49 4e 3d 22 22 2c 74 2e 46 4c 42 5f 50 4c 41 54 46 4f 52 4d 3d 22 77 65 62 22 2c 74 2e 46 42 5f 41 50 50 5f 49 44 3d 22 22 2c 74 2e 55 4e 4b 4e 4f 57 4e 5f 49 44 3d 22 57 41 55 6e 6b 6e 6f 77 6e 49 44 22 2c 74 2e 42 55 49 4c 44 5f 49 44 3d 22 35 37 33 31 30 37 35 39 39 22 2c 74 2e 42 55 49 4c 44 5f 54 49 4d 45 53 54 41 4d 50 3d 22 4d 61 72 63 68 20 34 2c 20 32 30 32 34 22 2c 74 2e 57 45 42 5f 50 55 42 4c 49 43 5f 50 41 54 48 3d 22 2f 22 2c 74 2e 42 55 49 4c 44 5f 55 52 4c 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 2e 77 68 61 74 73 61 70 70 2e 63 6f 6d 2f 22 2c 74 2e 55 53 45 52 5f 54 49 4d 49 4e 47 53 3d 21 31 7d 2c 34 37 32 Data Ascii: _ORIGIN="https://web.whatsapp.com/",t.WS_ORIGIN="",t.FLB_PLATFORM="web",t.FB_APP_ID="",t.UNKNOWN_ID="WAUnknownID",t.BUILD_ID="573107599",t.BUILD_TIMESTAMP="March 4, 2024",t.WEB_PUBLIC_PATH="/",t.BUILD_URL="https://web.whatsapp.com/",t.USER_TIMINGS=!1},472

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:23 UTC	640	OUT	GET /stylex-176c9103de3ad9ce77b1b6511982bf5d.css HTTP/1.1 Host: web.whatsapp.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://web.whatsapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-03-10 16:31:23 UTC	1983	IN	HTTP/1.1 200 OK Content-Type: text/css;charset=utf-8 Vary: Accept-Encoding, Referer Vary: Accept-Encoding reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.whatsapp.com/whatsapp_browser_error_reports/?device_level=unknown", permissions_policy="https://www.whatsapp.com/whatsapp_browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.whatsapp.com\/whatsapp_browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.whatsapp.com\/whatsapp_browser_error_reports\/"}],"group":"permissions_policy"} document-policy: force-load-at-top permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: unsafe-none;report-to="coop_report" Pragma: public Cache-Control: max-age=31449600 Expires: Sun, 09 Mar 2025 16:31:23 +0000 X-Content-Type-Options: nosniff X-XSS-Protection: 0
2024-03-10 16:31:23 UTC	1768	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 73 65 6c 66 27 3b 0d 0a 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 3b 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 77 68 61 74 73 61 70 70 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 3b 73 74 79 6c 65 2d 73 72 63 Data Ascii: content-security-policy: frame-ancestors 'self';content-security-policy: default-src 'self' data: blob:;script-src 'self' data: blob: 'unsafe-eval' 'unsafe-inline' https://static.whatsapp.net https://maps.googleapis.com https://www.youtube.com;style-src
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 2e 61 31 6d 39 71 7a 6a 61 7b 66 6c 65 78 3a 31 7d 0a 2e 61 6a 61 30 78 33 35 30 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 2e 61 6a 75 7a 67 6f 73 70 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 35 30 25 29 7d 0a 2e 61 6d 78 72 72 61 79 69 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 39 37 29 7d 0a 2e 61 6f 6c 61 6e 38 76 78 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 39 34 29 7d 0a 2e 62 34 61 37 38 72 65 34 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 7d 0a 2e 62 34 78 6d 38 72 6a 68 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 0a 2e 62 35 62 71 6e 75 39 32 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 32 34 30 25 29 7d Data Ascii: .a1m9qzja{flex:1}.aja0x350{text-decoration:none}.ajuzgosp{transform:translateX(50%)}.amxrrayi{transform:scale(.97)}.aolan8vx{transform:scale(.94)}.b4a78re4{transform:rotate(135deg)}.b4xm8rjh{transform:scale(1)}.b5bqnu92{transform:translateY(-240%)}
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 31 29 7d 0a 2e 67 6b 36 69 67 72 77 64 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 0a 2e 67 71 6f 6e 6f 63 6d 6e 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 31 32 30 25 29 7d 0a 2e 67 76 37 34 7a 78 79 73 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 31 2e 36 31 70 78 29 7d 0a 2e 68 61 69 67 74 32 74 63 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 33 73 20 65 61 73 65 7d 0a 2e 68 64 61 31 72 30 6c 30 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 38 32 29 7d 0a 2e 68 66 65 72 32 38 68 67 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 30 2c 2d 33 70 78 29 20 73 63 61 6c 65 28 2e 37 35 29 7d 0a 2e 68 68 67 72 70 73 78 30 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 Data Ascii: 1)}.gk6igrwd{outline:none}.gqonocmn{transform:translateY(-120%)}.gv74zxys{transform:translateX(1.61px)}.haigt2tc{transition:opacity .3s ease}.hda1r0l0{transform:scale(.82)}.hfer28hg{transform:translate(0,-3px) scale(.75)}.hhgrpsx0{transform:rotate(
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2e 39 39 35 70 78 29 7d 0a 2e 6f 37 7a 39 62 32 6a 67 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 31 30 30 25 29 7d 0a 2e 6f 62 6e 37 6a 76 6e 6b 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 30 2c 2d 32 70 78 29 20 73 63 61 6c 65 28 2e 38 35 29 7d 0a 2e 6f 64 6b 76 62 64 6f 31 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 2e 32 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 34 2c 30 2c 2e 32 2c 31 29 2c 6f 70 61 63 69 74 79 20 2e 32 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 34 2c 30 2c 2e 32 2c 31 29 7d 0a 2e 6f 66 30 75 76 7a 31 63 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 38 37 29 7d 0a 2e 6f 6e 6b 72 6b 32 66 74 Data Ascii: ransform:translateX(.995px)}.o7z9b2jg{transform:translateX(-100%)}.obn7jvnk{transform:translate(0,-2px) scale(.85)}.odkvbdo1{transition:transform .2s cubic-bezier(.4,0,.2,1),opacity .2s cubic-bezier(.4,0,.2,1)}.of0uvz1c{transform:scale(.87)}.onkrk2ft
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 66 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 61 36 68 64 6e 37 33 71 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 73 6f 6c 69 64 20 72 67 62 61 28 38 32 2c 32 34 38 2c 32 34 2c 31 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 61 36 68 64 6e 37 33 71 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 73 6f 6c 69 64 20 72 67 62 61 28 38 32 2c 32 34 38 2c 32 34 2c 31 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 61 66 37 64 34 35 35 66 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 76 61 72 28 2d 2d 69 6e 76 65 72 73 65 2d 72 67 62 29 2c 2e 31 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 61 66 37 64 34 35 35 66 7b 62 6f 72 64 65 72 2d 72 69 67 Data Ascii: f}html:not([dir='rtl']) .a6hdn73q{border-right:solid rgba(82,248,24,1)}html[dir='rtl'] .a6hdn73q{border-left:solid rgba(82,248,24,1)}html:not([dir='rtl']) .af7d455f{border-left:2px solid rgba(var(--inverse-rgb),.1)}html[dir='rtl'] .af7d455f{border-rig
2024-03-10 16:31:23 UTC	900	IN	Data Raw: 6d 3a 34 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 77 61 6c 6c 70 61 70 65 72 2d 74 68 75 6d 62 2d 62 6f 72 64 65 72 2d 61 63 74 69 76 65 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 62 6d 72 6f 36 70 6b 61 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 63 6f 6e 2d 64 69 73 61 62 6c 65 64 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 62 6d 72 6f 36 70 6b 61 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 63 6f 6e 2d 64 69 73 61 62 6c 65 64 29 7d 0a 2e 62 74 73 71 74 78 79 63 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 6e 76 65 72 73 65 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 Data Ascii: m:4px solid var(--wallpaper-thumb-border-active)}html:not([dir='rtl']) .bmro6pka{border-left:1px solid var(--icon-disabled)}html[dir='rtl'] .bmro6pka{border-right:1px solid var(--icon-disabled)}.btsqtxyc{border-top:1px solid var(--inverse)}html:not([d
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 77 64 73 2d 63 6f 6f 6c 2d 67 72 61 79 2d 31 30 30 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 63 79 68 68 76 71 66 30 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 63 6f 6e 76 65 72 73 61 74 69 6f 6e 2d 68 65 61 64 65 72 2d 62 6f 72 64 65 72 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 63 79 68 68 76 71 66 30 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 63 6f 6e 76 65 72 73 61 74 69 6f 6e 2d 68 65 61 64 65 72 2d 62 6f 72 64 65 72 29 7d 0a 2e 64 32 37 6b 72 32 72 74 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 75 6e 73 65 74 7d 0a 2e 64 33 31 31 65 71 66 78 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 Data Ascii: wds-cool-gray-100)}html:not([dir='rtl']) .cyhhvqf0{border-right:1px solid var(--conversation-header-border)}html[dir='rtl'] .cyhhvqf0{border-left:1px solid var(--conversation-header-border)}.d27kr2rt{border-top:unset}.d311eqfx{border-bottom:1px solid
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 61 72 28 2d 2d 6d 6f 64 61 6c 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 65 74 61 35 61 79 6d 31 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 30 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 65 74 61 35 61 79 6d 31 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 30 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 65 76 71 33 6d 72 6e 76 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 64 65 66 61 75 6c 74 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 65 76 71 33 6d 72 6e 76 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 64 65 66 Data Ascii: ar(--modal-background)}html:not([dir='rtl']) .eta5aym1{border-right:0}html[dir='rtl'] .eta5aym1{border-left:0}html:not([dir='rtl']) .evq3mrnv{border-right:1px solid var(--border-default)}html[dir='rtl'] .evq3mrnv{border-left:1px solid var(--border-def
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 32 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 6d 6f 64 61 6c 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 0a 2e 67 38 30 77 65 77 62 65 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 32 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 6c 69 67 68 74 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 67 39 65 62 66 39 79 70 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 75 6e 73 65 74 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 67 39 65 62 66 39 79 70 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 75 6e 73 65 74 7d 0a 2e 67 62 36 69 61 37 78 61 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 7d 0a 2e 67 62 6b 35 39 61 39 39 7b 62 6f 72 64 65 72 2d 74 6f 70 3a Data Ascii: {border-bottom:2px solid var(--modal-background)}.g80wewbe{border-top:2px solid var(--secondary-light)}html:not([dir='rtl']) .g9ebf9yp{border-left:unset}html[dir='rtl'] .g9ebf9yp{border-right:unset}.gb6ia7xa{border-top:1px solid}.gbk59a99{border-top:
2024-03-10 16:31:23 UTC	1500	IN	Data Raw: 62 6f 72 64 65 72 2d 73 74 72 6f 6e 67 65 72 29 7d 0a 2e 69 36 67 62 69 6d 75 36 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 33 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 65 66 61 75 6c 74 29 7d 0a 68 74 6d 6c 3a 6e 6f 74 28 5b 64 69 72 3d 27 72 74 6c 27 5d 29 20 2e 69 6b 6b 6f 79 6e 68 63 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 35 70 78 20 64 61 73 68 65 64 20 76 61 72 28 2d 2d 61 74 74 61 63 68 2d 6d 65 64 69 61 2d 64 72 6f 70 2d 62 6f 72 64 65 72 29 7d 0a 68 74 6d 6c 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 69 6b 6b 6f 79 6e 68 63 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 35 70 78 20 64 61 73 68 65 64 20 76 61 72 28 2d 2d 61 74 74 61 63 68 2d 6d 65 64 69 61 2d 64 72 6f 70 2d 62 6f 72 64 65 72 29 7d 0a 2e 69 6d 34 34 38 77 33 Data Ascii: border-stronger)}.i6gbimu6{border-top:3px solid var(--background-default)}html:not([dir='rtl']) .ikkoynhc{border-left:5px dashed var(--attach-media-drop-border)}html[dir='rtl'] .ikkoynhc{border-right:5px dashed var(--attach-media-drop-border)}.im448w3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	172.64.41.3	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-03-10 16:31:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-03-10 16:31:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 10 Mar 2024 16:31:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8624b1e46c8c0a01-LAS alt-svc: h3=":443"; ma=86400
2024-03-10 16:31:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e4 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	162.159.61.3	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-03-10 16:31:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-03-10 16:31:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 10 Mar 2024 16:31:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8624b1e46c6409ef-LAS alt-svc: h3=":443"; ma=86400
2024-03-10 16:31:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49758	20.118.82.167	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:28 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 754 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiZVBGM3g4bUZHakJPTU9JNXhHWkQwUT09IiwgImhhc2giOiJ5V21Ib0VjdVRITT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-03-10 16:31:28 UTC	754	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-03-10 16:31:28 UTC	252	IN	HTTP/1.1 200 OK Date: Sun, 10 Mar 2024 16:31:28 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:68ed2408-46f3-4e32-b9aa-2544a61aa301
2024-03-10 16:31:28 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-03-10 16:31:28 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-03-10 16:31:28 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-03-10 16:31:28 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-03-10 16:31:28 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-03-10 16:31:28 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-03-10 16:31:29 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-03-10 16:31:29 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-03-10 16:31:29 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	20.118.82.167	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:31 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 754 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiZVBGM3g4bUZHakJPTU9JNXhHWkQwUT09IiwgImhhc2giOiJ5V21Ib0VjdVRITT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-03-10 16:31:31 UTC	754	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-03-10 16:31:31 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 10 Mar 2024 16:31:31 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:68ed2408-46f3-4e32-b9aa-2544a61aa301
2024-03-10 16:31:31 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	20.118.82.167	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:31 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 754 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiZVBGM3g4bUZHakJPTU9JNXhHWkQwUT09IiwgImhhc2giOiJ5V21Ib0VjdVRITT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-03-10 16:31:31 UTC	754	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-03-10 16:31:32 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 10 Mar 2024 16:31:32 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:68ed2408-46f3-4e32-b9aa-2544a61aa301
2024-03-10 16:31:32 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-03-10 16:31:32 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-03-10 16:31:32 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49766	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:37 UTC	732	OUT	POST /wa_qpl_data HTTP/1.1 Host: graph.whatsapp.net Connection: keep-alive Content-Length: 1186 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIdIA2DLLOnPRD8FE Accept: / Origin: https://web.whatsapp.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://web.whatsapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-03-10 16:31:37 UTC	1186	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 64 49 41 32 44 4c 4c 4f 6e 50 52 44 38 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 63 65 73 73 5f 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 30 36 33 31 32 37 37 35 37 31 31 33 33 39 39 7c 37 34 35 31 34 36 66 66 61 33 34 34 31 33 66 39 64 62 62 35 34 36 39 66 35 33 37 30 62 37 61 66 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 64 49 41 32 44 4c 4c 4f 6e 50 52 44 38 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 70 70 5f 69 64 22 0d 0a 0d 0a 31 36 37 30 32 38 36 39 30 35 33 35 33 32 32 0d Data Ascii: ------WebKitFormBoundaryIdIA2DLLOnPRD8FEContent-Disposition: form-data; name="access_token"1063127757113399\|745146ffa34413f9dbb5469f5370b7af------WebKitFormBoundaryIdIA2DLLOnPRD8FEContent-Disposition: form-data; name="app_id"167028690535322
2024-03-10 16:31:38 UTC	607	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: Accept-Encoding Access-Control-Allow-Origin: * facebook-api-version: v13.0 Strict-Transport-Security: max-age=15552000; preload Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT x-fb-request-id: AxYP0oQlAVvaLiDpzcEEZSE x-fb-trace-id: EjKDce+zDf/ x-fb-rev: 1011957409 X-FB-Debug: SwForWoqvClUkyE0opRC1COvFSbaVl5G/gRsB1ejy7gZ9E4fgcEh42tMYxQHCsH3HyC/5EA7+0fsY6LIRHYrMw== Date: Sun, 10 Mar 2024 16:31:38 GMT Connection: close Content-Length: 22
2024-03-10 16:31:38 UTC	22	IN	Data Raw: 7b 0a 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 0a 7d Data Ascii: { "success": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49767	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:47 UTC	533	OUT	GET /ws/chat HTTP/1.1 Host: web.whatsapp.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Upgrade: websocket Origin: https://web.whatsapp.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Sec-WebSocket-Key: CyBqXT+TEqvEfDjXYOiLfQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-03-10 16:31:47 UTC	63	IN	HTTP/1.1 400 Bad Request Date: Sun, 10 Mar 2024 16:31:47 GMT
2024-03-10 16:31:47 UTC	2591	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4a 38 46 71 42 30 43 65 63 62 31 51 49 41 41 69 47 31 6e 49 6a 62 66 45 79 45 44 4d 72 34 77 78 4a 69 30 7a 65 63 4e 37 6b 58 5f 56 55 4e 69 32 6c 61 57 64 36 49 73 61 58 47 73 51 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4b 50 39 64 31 51 31 50 75 6f 58 62 41 6f 52 2d 71 49 37 49 41 48 46 59 71 76 67 67 6c 4d 36 73 37 73 38 51 42 43 65 4d 42 68 6b 6c 79 6b 69 53 59 4d 58 55 58 75 70 54 55 75 74 35 5a 61 64 73 42 62 63 32 66 42 32 69 39 41 34 51 38 46 5f 78 4b 31 46 46 51 63 72 54 2d 51 70 43 44 56 46 7a 5a 7a 56 6a 39 37 73 64 7a 31 72 52 69 78 22 3b 20 65 5f 66 62 5f 76 69 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcJ8FqB0Cecb1QIAAiG1nIjbfEyEDMr4wxJi0zecN7kX_VUNi2laWd6IsaXGsQ"; e_clientaddr="AcKP9d1Q1PuoXbAoR-qI7IAHFYqvgglM6s7s8QBCeMBhklykiSYMXUXupTUut5ZadsBbc2fB2i9A4Q8F_xK1FFQcrT-QpCDVFzZzVj97sdz1rRix"; e_fb_vi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49768	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:31:51 UTC	533	OUT	GET /ws/chat HTTP/1.1 Host: web.whatsapp.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Upgrade: websocket Origin: https://web.whatsapp.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Sec-WebSocket-Key: cHU1+tHHVTa94ohtwhrPqw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-03-10 16:31:51 UTC	63	IN	HTTP/1.1 400 Bad Request Date: Sun, 10 Mar 2024 16:31:51 GMT
2024-03-10 16:31:51 UTC	2593	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4c 64 50 6a 46 32 64 67 61 34 48 33 41 71 76 6f 73 51 4a 4b 78 74 30 69 72 69 2d 43 58 43 58 4c 6e 45 49 4d 4d 6d 54 71 68 34 57 72 56 73 69 30 45 76 54 32 37 41 4b 77 68 44 71 77 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4a 51 52 73 74 47 31 48 62 6f 34 4e 32 68 2d 79 33 36 6a 42 5a 64 39 78 36 44 72 6f 31 7a 45 74 62 77 33 76 77 6d 32 57 4c 34 50 58 47 76 6a 78 43 37 70 53 64 67 46 78 38 50 61 6c 34 79 74 44 32 46 78 71 43 46 53 79 37 43 6d 45 34 38 34 65 6d 45 4f 62 66 41 77 4f 34 4d 71 69 71 4d 52 57 34 57 47 48 31 48 6f 52 6a 5f 2d 62 44 77 22 3b 20 65 5f 66 62 5f 76 69 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcLdPjF2dga4H3AqvosQJKxt0iri-CXCXLnEIMMmTqh4WrVsi0EvT27AKwhDqw"; e_clientaddr="AcJQRstG1Hbo4N2h-y36jBZd9x6Dro1zEtbw3vwm2WL4PXGvjxC7pSdgFx8Pal4ytD2FxqCFSy7CmE484emEObfAwO4MqiqMRW4WGH1HoRj_-bDw"; e_fb_vi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49769	31.13.65.49	443	5724	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-10 16:32:04 UTC	533	OUT	GET /ws/chat HTTP/1.1 Host: web.whatsapp.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Upgrade: websocket Origin: https://web.whatsapp.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Sec-WebSocket-Key: ZPNXETgzC0nJavj88P4KpA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-03-10 16:32:04 UTC	63	IN	HTTP/1.1 400 Bad Request Date: Sun, 10 Mar 2024 16:32:04 GMT
2024-03-10 16:32:04 UTC	2594	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4c 49 51 53 48 50 51 4c 49 4c 6f 42 50 38 78 2d 33 5f 59 58 63 48 4b 50 64 6a 6f 32 64 6c 2d 77 67 41 71 6e 33 63 62 78 6c 6d 6f 6d 6a 30 5a 34 4e 67 71 45 78 66 63 42 44 61 59 41 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 49 43 78 44 53 36 73 63 65 36 4b 62 47 49 49 47 76 73 32 52 64 35 70 66 6b 56 71 34 31 6f 34 78 5f 76 57 73 6c 35 75 77 71 51 57 4f 76 4e 33 36 4d 68 35 4b 46 54 2d 71 66 6b 36 5f 2d 49 75 4a 2d 75 4b 79 38 43 4b 46 59 4d 37 6a 6b 4b 6f 6f 57 76 46 5f 4e 6e 62 53 55 5a 57 4e 5a 32 35 65 6e 4e 39 61 67 4c 2d 55 61 76 73 54 73 6c 75 77 22 3b 20 65 5f 66 62 5f Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcLIQSHPQLILoBP8x-3_YXcHKPdjo2dl-wgAqn3cbxlmomj0Z4NgqExfcBDaYA"; e_clientaddr="AcICxDS6sce6KbGIIGvs2Rd5pfkVq41o4x_vWsl5uwqQWOvN36Mh5KFT-qfk6_-IuJ-uKy8CKFYM7jkKooWvF_NnbSUZWNZ25enN9agL-UavsTsluw"; e_fb_

Target ID:	0
Start time:	17:30:03
Start date:	10/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12642.14495.exe
Imagebase:	0x100000
File size:	3'511'296 bytes
MD5 hash:	F24A4D5B6036A3DE2EBA88868BD771F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2075054867.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2075054867.00000000028E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2103267180.0000000007BA8000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2075925447.0000000003C18000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	17:30:04
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	17:30:04
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:30:04
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell set-mppreference -exclusionpath C:\
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	17:30:36
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Botmaster 5.8 direct.exe"
Imagebase:	0x400000
File size:	3'178'277 bytes
MD5 hash:	C9C01FDC7D3AD84CEEB43C6B099A8AD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	17:30:37
Start date:	10/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Imagebase:	0x2b0000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	17:30:37
Start date:	10/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Imagebase:	0x2e0000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	17:30:37
Start date:	10/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Imagebase:	0x490000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2995046316.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 0000000B.00000002.3099898068.0000000007450000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000B.00000002.3028502871.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Target ID:	12
Start time:	17:30:42
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0xdb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	17:30:42
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	17:30:44
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0x920000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	15
Start time:	17:30:44
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	17:30:48
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Local\WinUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WinUpdate.exe"
Imagebase:	0x960000
File size:	3'511'296 bytes
MD5 hash:	F24A4D5B6036A3DE2EBA88868BD771F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2198821760.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2198821760.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2203478621.0000000004091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2198821760.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2198821760.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2198821760.00000000032E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2261869120.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	17:30:49
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /k START "" "C:\Users\user\AppData\Local\WinUpdate.exe" & EXIT
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	17:30:49
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	21
Start time:	17:30:50
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Local\WinUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WinUpdate.exe"
Imagebase:	0x370000
File size:	3'511'296 bytes
MD5 hash:	F24A4D5B6036A3DE2EBA88868BD771F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000015.00000002.2561460834.0000000002A32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000015.00000002.2575343992.0000000004984000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000015.00000002.2561460834.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	22
Start time:	17:30:51
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	17:30:51
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	17:30:51
Start date:	10/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell set-mppreference -exclusionpath C:\
Imagebase:	0x460000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: XClient.exePID: 1836, Parent PID: 2580

General

Target ID:	26
Start time:	17:30:56
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x150000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	17:30:56
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	17:30:58
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Bot Master\Bot Master\BotMaster.exe
Imagebase:	0xee0000
File size:	2'941'952 bytes
MD5 hash:	895F3A548FD8FA6FD1355AF6D218DA2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	false

Target ID:	29
Start time:	17:31:00
Start date:	10/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	30
Start time:	17:31:01
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0xa60000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	17:31:01
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	17:31:02
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.865895741088582256
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	17:31:02
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x15c,0x170,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	17:31:03
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:2
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	17:31:03
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2212 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:3
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	17:31:03
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2452 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:8
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	17:31:04
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883373791 --launch-time-ticks=6381239210 --mojo-platform-channel-handle=3372 --field-trial-handle=1788,i,16355195492384305926,16374920603742595723,262144 --enable-features=MojoIpcz /prefetch:1
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	17:31:04
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Local\WinUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WinUpdate.exe"
Imagebase:	0xfc0000
File size:	3'511'296 bytes
MD5 hash:	F24A4D5B6036A3DE2EBA88868BD771F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2375843757.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2375843757.0000000003B2E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2439203384.0000000006B5D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2375843757.000000000381E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2375843757.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000027.00000002.2375843757.0000000003B12000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	40
Start time:	17:31:06
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.16963202530693688502
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	17:31:07
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x164,0x168,0x16c,0x13c,0x1a4,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	17:31:13
Start date:	10/03/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0xe10000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	43
Start time:	17:31:13
Start date:	10/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	44
Start time:	17:31:17
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:2
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	45
Start time:	17:31:17
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2376 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:3
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	46
Start time:	17:31:17
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3736.6896.10684777464287357477
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	47
Start time:	17:31:18
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2628 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:8
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	48
Start time:	17:31:18
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a0,0x7ffdfb318e88,0x7ffdfb318e98,0x7ffdfb318ea8
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	49
Start time:	17:31:18
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395273895 --mojo-platform-channel-handle=3444 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	50
Start time:	17:31:19
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6395660630 --mojo-platform-channel-handle=3580 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	52
Start time:	17:31:20
Start date:	10/03/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\BotMaster\DefaultProfiles\EBWebView" --webview-exe-name=BotMaster.exe --webview-exe-version=5.8.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710081883367231 --launch-time-ticks=6396649396 --mojo-platform-channel-handle=3976 --field-trial-handle=1228,i,12600584099610770697,13500471582156680375,262144 --enable-features=MojoIpcz /prefetch:1
Imagebase:	0x7ff67d0c0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false